Direct naar de inhoud
MededelingAWS meldt wijdverbreide misbruikpogingen tegen php2shell (update van 22 okt.). Draait uw PHP nog niet op een gepatchte versie, update dan nu.Details
Kritiek CVE-2026-109618 · CVE-2026-109619/ CVSS 9.2 / Bekendgemaakt 2026-10-21 Bijgewerkt
php2shellcheck
NL
EnglishEN 日本語JA DeutschDE FrançaisFR NederlandsNL
Hulp nodig
Menu

Fixstatus php2shell

Eén pagina met de stand van elke fix: upstream PHP, takken zonder support, Linux-distributies, de Docker-image en hostingproviders. Elke status is berekend uit dezelfde gegevens als de tabel met opgeloste versies.

Bijgewerkt: RSS-feed

Totaal

Deels opgelost

Voor sommige onderdelen is er een officiële fix, voor andere nog niet. Zoek de rijen die bij jouw situatie passen.

AWS meldt wijdverbreide pogingen om php2shell te misbruiken (22 oktober 2026). AWS schrijft ook dat onduidelijk is of die pogingen op echte systemen slaagden.

7 opgelost6 deels opgelost

Onderdelen

  • OpgelostHet project of de leverancier publiceert een opgeloste versie.
  • Deels opgelostSommige onderdelen zijn opgelost, of er is alleen een broncodepatch.

Upstream PHP

OnderdeelStatusDetailsBron
PHP 8.5
Opgelost

Opgelost in 8.5.12, uitgebracht op 2026-10-21.
Bron
PHP 8.4
Opgelost

Opgelost in 8.4.27, uitgebracht op 2026-10-21.
Bron
PHP 8.3
Opgelost

Opgelost in 8.3.36, uitgebracht op 2026-10-21.
Bron
PHP 8.2
Opgelost

Opgelost in 8.2.35, uitgebracht op 2026-10-21.
Bron

Takken zonder support

OnderdeelStatusDetailsBron
PHP 7.4
Deels opgelost

php.net publiceerde alleen een broncodepatch: geen release en geen versienummer.
Bron
PHP 8.0
Deels opgelost

php.net publiceerde alleen een broncodepatch: geen release en geen versienummer.
Bron
PHP 8.1
Deels opgelost

php.net publiceerde alleen een broncodepatch: geen release en geen versienummer.
Bron

Distributies en images

OnderdeelStatusDetailsBron
Ubuntu
Opgelost

Records van leveranciers: 8 opgelost / 2 zonder support (niet meegeteld)

Voor 4 van de fixes is Ubuntu Pro nodig.
Opgeloste versies
Debian
Deels opgelost

Records van leveranciers: 3 opgelost / 1 nog geen fix / 1 onbevestigd
Opgeloste versies
RHEL / AlmaLinux / Rocky
Deels opgelost

Records van leveranciers: 18 opgelost / 3 nog geen fix / 9 onbevestigd
Opgeloste versies
Alpine
Opgelost

Records van leveranciers: 13 opgelost / 7 zonder support (niet meegeteld)
Opgeloste versies
Officiële Docker-image
Opgelost

Records van leveranciers: 4 opgelost / 3 zonder support (niet meegeteld)
Opgeloste versies

Hostingproviders

OnderdeelStatusDetailsBron
Grote hosters
Deels opgelost

Gepatcht volgens de hoster zelf: 25 van 70. Uitrol bezig of gepland: 17. Zelf actie nodig of alleen een workaround: 21. Onbevestigd of geen melding: 7.
Hosterstatus

Tijdlijn

Officiële gebeurtenissen, nieuwste eerst. Elk item linkt naar zijn bron.

  1. AWS updated its php2shell post: it now says it is seeing broad exploitation attempts in the wild (on 21 Oct it said 'being broadly exploited'). It still says it is unclear whether any of these attempts succeeded on real systems. Bron
  2. DreamHost says the official PHP security updates have now been applied across its entire network. It has not said whether the fixes it promised for PHP 8.1 and older (PHP Extended Support) were delivered, so we still list it as rolling out. Bron
  3. A2 Hosting closed its PHP update incident, saying the PHP-related service update has been completed successfully. The closing note names no CVE or PHP versions, so we still list it as rolling out. Bron
  4. CERT.LV, Latvia's national CERT, says automated attempts to exploit the PHP vulnerabilities have been detected in Latvia, with no reports of successful attacks so far. Bron
  5. Alpine 3.22 published fixed PHP packages in its community repository: php84 8.4.27-r0, php83 8.3.36-r0 and php82 8.2.35-r0, although that repository is past its end-of-support date. Bron
  6. Oracle published fixed PHP modules for Oracle Linux 9: php:8.3 in ELSA-2026-87079 (8.3.36-1.module+el9.8.0+91082+c865dc1a) and php:8.2 in ELSA-2026-87072 (8.2.35-1.module+el9.8.0+91079+4ad1bd7f). Bron
  7. AlmaLinux published fixed PHP packages: AlmaLinux 10 php 8.3.36-1.el10_2 (ALSA-2026:87070) and php8.4 8.4.27-1.el10_2 (ALSA-2026:87071), AlmaLinux 9 php:8.3 (ALSA-2026:87079) and AlmaLinux 8 php:7.4 (ALSA-2026:87080). Its AlmaLinux 9 php:8.2 advisory lists no php package build, so that stream stays unconfirmed. Bron
  8. GoDaddy says all PHP versions on Web Hosting are now patched, so Web Hosting, Managed Hosting for WordPress and Windows Hosting need no customer action. VPS owners still update PHP themselves. Bron
  9. Namecheap says its PHP maintenance on shared hosting servers has finished and marked its notice resolved. VPS and dedicated server owners update PHP themselves. Bron
  10. Nexcess says most affected hosts are now patched and patching is underway on the rest. Bron
  11. Rocky Linux published RLSA-2026:87073 with a fixed php:8.2 package for Rocky Linux 8: 8.2.35-1.module+el8.10.0+40394+d21b33fb. Bron
  12. Oracle published fixed PHP modules for Oracle Linux 8: php:8.2 in ELSA-2026-87073 (8.2.35-1.module+el8.10.0+91081+33b5c645) and php:7.4 in ELSA-2026-87080 (7.4.33-8.module+el8.10.0+91080+9785160d). Bron
  13. Alpine now lists fixed php packages in the repository index for Alpine 3.23 (php85 8.5.12-r0, php84 8.4.27-r0, php83 8.3.36-r0) and Alpine 3.21 (php82 8.2.35-r0). Bron
  14. AWS says Elastic Beanstalk Amazon Linux 2023 PHP platform version 4.13.13 now ships PHP 8.3.36 and PHP 8.2.35, after PHP 8.5.12 and 8.4.27 on 21 Oct. Environments need a platform update unless Managed Platform Updates is on. Bron
  15. Hostinger says PHP upgrades are now complete across all managed hosting servers (22 Oct, 06:44 UTC). VPS customers manage PHP themselves. Bron
  16. IONOS says it has rolled out the official PHP updates across all platforms it operates itself (incident resolved 22 Oct, 10:10 UTC). Owners of a VPS or dedicated server must update PHP themselves. Bron
  17. Infomaniak says the PHP security fixes are deployed on its entire shared Web Hosting and Cloud Server infrastructure for PHP 8.5, 8.4, 8.3, 8.2, 8.1, 8.0 and 7.4. Bron
  18. Kinsta says all sites are protected and the PHP security updates have been rolled out across the platform (incident resolved 22 Oct, 08:26 UTC). Bron
  19. ConoHa says in its final report that the security patches are applied to ConoHa WING servers (status as of 20:45 JST on 22 Oct) and customers do not need to change their PHP version. Bron
  20. Value Domain's notices now say the fix is complete for every PHP version offered on CORESERVER V1 (5.3 to 8.5), CORESERVER V2 (5.2 to 8.5), XREA and VALUESERVER (5.3 to 8.5 each) and One Rental Server (5.6 to 8.5). Bron
  21. Xserver says on its official X account that fix patches are applied on all target servers for PHP 5.6 to 8.5, and that patches for PHP 5.5 and older are still being created and verified. Bron
  22. KAGOYA says it is updating Rental Server plans to the fixed PHP versions in sequence and expects to finish at 24:00 JST on 22 Oct. Bron
  23. A2 Hosting says it is rolling out the upstream PHP security patches on its cPanel/Plesk and Enhance platforms; self-managed server owners must apply the vendor updates themselves. Bron
  24. AWS (Amazon Threat Intelligence) says php2shell is now being broadly exploited in the wild, and that its honeypot sensors recorded an exploitation attempt dated 17 Oct, four days before disclosure. AWS adds that it is unclear whether those attempts succeeded on real systems. CISA's KEV catalog does not list either CVE as of 22 Oct. Bron
  25. Amazon published a fixed php8.5 package for the Amazon Linux 2027 Preview: 8.5.12-1.amzn2027.0.1 (ALAS2027-2026-243). Bron
  26. Hostnet says the PHP security update is rolled out on all of its systems, including older PHP versions via PHP Extended Support, and has lifted its temporary measures. Bron
  27. Hetzner says it has also deployed patches for PHP 5.6 and 7.3 on all Webhosting and Managed Servers, after PHP 7.4 and 8.0 to 8.5. Bron
  28. Upsun says the PHP security patch has finished deploying to all Dedicated clusters, after updated images reached all grid regions. Bron
  29. CPI says it is urgently applying the latest PHP patches on the versions that have one, and will post an update on versions without a patch. Bron
  30. Red Hat's CVE pages now list fixed packages. RHEL 10: php 8.3.36-1.el10_2 (RHSA-2026:87070) and php8.4 8.4.27-1.el10_2 (RHSA-2026:87071). RHEL 9: php 8.0.30-8.el9_8.1 (RHSA-2026:87151), php:8.2 (RHSA-2026:87072) and php:8.3 (RHSA-2026:87079). RHEL 8: php:8.2 (RHSA-2026:87073), after php:7.4 (RHSA-2026:87080). RHEL 9 php:8.4 is still listed as Affected with no advisory, and RHEL 7 as 'Under investigation' for CVE-2026-109618 and 'Not affected' for CVE-2026-109619. Bron
  31. Rocky Linux published fixed PHP packages. Rocky Linux 10: php 8.3.36-1.el10_2 (RLSA-2026:87070) and php8.4 8.4.27-1.el10_2 (RLSA-2026:87071). Rocky Linux 9: php 8.0.30-8.el9_8.1 (RLSA-2026:87151), php:8.2 (RLSA-2026:87072) and php:8.3 (RLSA-2026:87079). Rocky Linux 8: php:7.4 (RLSA-2026:87080). There is no advisory yet for Rocky Linux 9 php:8.4 or Rocky Linux 8 php:8.2. Bron
  32. Oracle's CVE pages list errata for Oracle Linux 10 (ELSA-2026-87070 php 8.3.36-1.el10_2 and ELSA-2026-87071 php8.4 8.4.27-1.el10_2) and Oracle Linux 9 (ELSA-2026-87151 php 8.0.30-8.el9_8.1). They list no php module stream for Oracle Linux 9 and no entry yet for Oracle Linux 8. Bron
  33. Amazon Linux 2023: ALAS2023-2026-3301 to ALAS2023-2026-3304 list fixed packages for php8.2 (8.2.35-1.amzn2023.0.1), php8.3 (8.3.36-1.amzn2023.0.1), php8.4 (8.4.27-1.amzn2023.0.1) and php8.5 (8.5.12-1.amzn2023.0.1). Bron
  34. Amazon Linux 2: ALAS2PHP8.2-2026-015 lists the fixed php 8.2.35-1.amzn2.0.1 packages for the amazon-linux-extras php8.2 stream. Bron
  35. Amazon's CVE pages list php8.1 on Amazon Linux 2023 and the Amazon Linux 2 core php package as 'No Fix Planned'; no fixed package is shown for either. Bron
  36. Alpine edge: php83 8.3.36-r0, php84 8.4.27-r0 and php85 8.5.12-r0 are now in the x86_64 community package index. Not every architecture is updated yet (x86, ppc64le, s390x and riscv64 still listed older builds at our check). Bron
  37. Debian's security tracker lists php8.4 8.4.27-1 as the fix in unstable (sid) for both CVEs. Testing (forky) still has php8.4 8.4.26-1, which the tracker marks vulnerable. Bron
  38. Debian 11 (bullseye): Debian itself has no php7.4 entry for these CVEs because Long Term Support ended on 31 August 2026. Freexian's paid Extended LTS service lists 7.4.33-1+deb11u14 (ELA-1853-1), available only to its subscribers. Bron
  39. Remi's repository (third-party) has PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 builds for Enterprise Linux 10, dated 21 October. Remi does not name the CVEs; these are the upstream fixed versions. Bron
  40. Remi's repository (third-party) has PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 builds for Enterprise Linux 9, dated 21 October. Remi does not name the CVEs; these are the upstream fixed versions. Bron
  41. Remi's repository (third-party) has PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 builds for Enterprise Linux 8, dated 21 October. Remi does not name the CVEs; these are the upstream fixed versions. Bron
  42. JVN (JPCERT/CC and IPA) published vulnerability note JVNVU#99905564 for both CVEs. It points to the PHP Group advisory and does not name fixed versions itself. Bron
  43. The Canadian Centre for Cyber Security published alert AL26-026 listing the fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It says a proof of concept is reported in open sources and that it has identified no active exploitation at this time. Bron
  44. The PHP Foundation says proof-of-concept code circulated more widely on 21 October, and that its security team did not identify any functional exploits at the time of release. Bron
  45. GoDaddy says Managed Hosting for WordPress is fully patched and needs no action. Web Hosting and Windows Hosting are mitigated while it waits for patched packages from its vendor, and VPS owners must update PHP themselves. Bron
  46. WP Engine says it has finished deploying the PHP security patches on its platform and no action is needed (updated builds named: 7.4.33.17, 8.2.35, 8.4.27 and 8.5.12). Bron
  47. Cloudways says patches are applied for all customer applications on its Autonomous product and are still rolling out for applications on Flexible. Bron
  48. Liquid Web published its patched build numbers (cPanel PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and Plesk v18.0.81.4) and says patched builds are still being deployed across its infrastructure. Customers who are not patched yet should run a package update in their control panel. Bron
  49. DigitalOcean says the App Platform PHP buildpack is patched. You must redeploy your app to pick it up, and apps built from your own Dockerfile or image need PHP updated in that image. Bron
  50. AWS Elastic Beanstalk released Amazon Linux 2023 PHP 8.5 and PHP 8.4 platform versions (4.13.13) with PHP 8.5.12 and 8.4.27. A later release is to update the PHP 8.3 and PHP 8.2 platform branches. Bron
  51. AWS published Lightsail guidance for updating PHP yourself. Instances from Lightsail-packaged blueprints update PHP with the package manager; Bitnami-blueprint instances keep their own copy of PHP that apt upgrade does not update. AWS lists the fixed versions as 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Bron
  52. netcup says all Webhosting packages (including Reseller) and all Managed Servers are patched and online. Root server, VPS and managed cloud cluster customers must patch PHP themselves. Bron
  53. CloudLinux says its release of fixed alt-php packages is complete (22 October, 00:07 UTC) and a regular update installs them, followed by a PHP restart. The packages carry the fix as a backport and keep their own lower version numbers, so check the package changelog. Bron
  54. Plesk says its own interface engine (sw-engine) is fixed in Plesk Obsidian 18.0.80 Update 11 and 18.0.81 Update 4, and asks customers to update Plesk to the latest available version. Bron
  55. aaPanel now says patches are available in its App Store for PHP 7.4 to 8.5; update each installed PHP version there. Users on PHP 7.3 or older are pointed to configuration mitigation only. Bron
  56. Sakura Internet says the fix is complete for every PHP version selectable in the Rental Server and Managed Server control panel. phpMyAdmin and webmail used by some services are still being handled. Bron
  57. GMO Pepabo says on its official X account that Lolipop has the fixed version applied and customer sites were restored at 13:11 JST on 22 October. It also applied its own fixes to older PHP versions that have no official fix. Bron
  58. GMO Pepabo says heteml has the official fixed versions for the PHP 8 series and PHP 7.4, and its own fix for all other versions. Some functions are disabled on PHP 8.1 and below. Bron
  59. ColorfulBox says the security fix is complete on all its servers as of the morning of 22 October, and customers do not need to change their PHP version. Bron
  60. mixhost says it finished applying the PHP fix packages on all its rental servers at about 10:18 JST on 22 October (PHP 5.2 to 8.5). The PHP version number shown does not change, and no customer action is needed. Bron
  61. ConoHa says it is applying security patches to ConoHa WING servers in sequence and keeping each customer's current PHP version. Bron
  62. GMO Internet says it is applying security patches to Onamae.com Rental Server servers in sequence and keeping each customer's current PHP version. A change may be needed for some customers on PHP 5.x or 7.x. Bron
  63. Value Domain's status page says the fix is complete on CORESERVER V2 for every PHP version it offers, and on CORESERVER V1 for PHP 7.4 and later. Older PHP versions on V1 are not mentioned. Bron
  64. Value Domain's status page says the fix is complete on XREA for PHP 7.4 and later. Older PHP versions are not mentioned. Bron
  65. Value Domain's status page says the fix is complete on VALUESERVER for PHP 7.4 and later. Older PHP versions are not mentioned. Bron
  66. Value Domain's status page says the fix is complete on One Rental Server for PHP 8.0 and later. Older PHP versions are not mentioned. Bron
  67. NTTPC published a notice for WebARENA SuiteX naming both CVEs. Web access from outside Japan is restricted and one PHP function (file-upload progress) is disabled as mitigations; the notice does not say a PHP fix has been applied. Bron
  68. Red Hat released RHSA-2026:87080 for RHEL 8 php:7.4 (7.4.33-8.module+el8.10.0+25117+30337cca), which fixes both CVEs. Bron
  69. Alpine 3.24: php83 8.3.36-r0, php84 8.4.27-r0 and php85 8.5.12-r0 are now in the x86_64 community repository. On Alpine edge, php83 8.3.36-r0 is listed in the security database but the package is not in the repository yet. Bron
  70. Homebrew: php is now 8.5.12, php@8.4 is 8.4.27, php@8.3 is 8.3.36 and php@8.2 is 8.2.35. Bron
  71. NVD added its own CVSS 3.1 score of 9.8 (Critical) for both CVEs, and its affected-version data now also covers PHP versions older than 8.2.35. Bron
  72. Laravel Cloud says every running application is now patched (PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35). Bron
  73. Hetzner says PHP 7.4 and 8.0 to 8.5 are patched on all Webhosting and Managed Servers. Bron
  74. OVHcloud says PHP 7.4 to 8.5 are patched on all Web Hosting clusters. Bron
  75. Flywheel says patching of its platform is finished and no customer action is needed. Bron
  76. Azure App Service finished rolling out patched PHP images to the Latest and Standard channels (8.2.35, 8.3.36, 8.4.27, 8.5.12). Bron
  77. Plesk now has PHP 8.2 to 8.5 fixes for Windows too, and says rebuilt 7.4, 8.0 and 8.1 packages on Linux include the fix. Bron
  78. DirectAdmin released a further build with patches for PHP 7.3 down to 5.6. Bron
  79. CloudLinux released more fixed alt-php builds (alt-php74, alt-php80 and alt-php81 on more platforms); other versions are still in preparation. Bron
  80. Webuzo published patched EMPS packages and tells users to run the EMPS update command. CyberPanel says fixed LiteSpeed PHP packages (8.2.35, 8.3.36, 8.4.27, 8.5.12) are available and administrators must update. Bron
  81. Debian's security tracker lists fixed php8.4 packages for Debian 13 (DSA-6574-1) and php8.2 packages for Debian 12 (DLA-4848-1). Bron
  82. The official Docker php images were rebuilt with PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Bron
  83. Ubuntu published USN-8948-1 and USN-8948-2 with fixed PHP packages (Ubuntu 20.04 and older through Ubuntu Pro). Bron
  84. php.net released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix CVE-2026-109618 and CVE-2026-109619. Bron

Toon het op je site

Twee kleine dingen voor je eigen site of README. Beide linken terug naar php2shellcheck.com.

Badge “gepatcht”

Deze badge is een eigen verklaring van de site-eigenaar. php2shellcheck controleert, verifieert of bewaakt hem niet en scant nooit een site. Plaats hem pas als je PHP op een officiële opgeloste versie draait.

Lichtphp2shell: gepatcht (eigen verklaring, niet gecontroleerd door php2shellcheck.com)

Donkerphp2shell: gepatcht (eigen verklaring, niet gecontroleerd door php2shellcheck.com)

Markdown

[![php2shell: gepatcht (eigen verklaring, niet gecontroleerd door php2shellcheck.com)](https://php2shellcheck.com/badge/php2shell-patched.svg)](https://php2shellcheck.com/nl/)

HTML

<a href="https://php2shellcheck.com/nl/"><img src="https://php2shellcheck.com/badge/php2shell-patched.svg" alt="php2shell: gepatcht (eigen verklaring, niet gecontroleerd door php2shellcheck.com)" width="232" height="20"></a>

HTML, licht en donker

<a href="https://php2shellcheck.com/nl/">
  <picture>
    <source media="(prefers-color-scheme: dark)" srcset="https://php2shellcheck.com/badge/php2shell-patched-dark.svg">
    <img src="https://php2shellcheck.com/badge/php2shell-patched.svg" alt="php2shell: gepatcht (eigen verklaring, niet gecontroleerd door php2shellcheck.com)" width="232" height="20">
  </picture>
</a>

Statuskaart

Een compacte kaart met de algemene fixstatus, de opgeloste upstream-versies en de laatste update. Plak dit iframe waar je het wilt hebben.

Aanbevolen formaat: breedte 100% (minimaal 280 px, maximaal 480 px), hoogte 509 px. De kaart bevat geen scripts en geen tracking.

<iframe src="https://php2shellcheck.com/nl/embed/status/" title="Fixstatus php2shell" width="100%" height="509" style="border:0;min-width:280px;max-width:480px" loading="lazy"></iframe>

Bekijk een voorbeeld van de kaart

Vertel het een collega

Kopieer dit bericht en stuur het per chat of e-mail.

De php2shell-kwetsbaarheden in PHP zijn als kritiek beoordeeld. De officiële opgeloste versies zijn PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. Controleer even welke PHP-versie je draait: https://php2shellcheck.com/nl/

E-mailupdates

Een e-mail als de status van de oplossingen verandert

Eén korte e-mail, alleen wanneer een officiële bron een opgeloste versie of de status van een leverancier wijzigt. Elke e-mail verwijst naar de bron.

We bewaren je adres en taal tot je je uitschrijft. Details in het privacybeleid. Liever geen e-mail? Volg de RSS-feed.