PHP Site AuditPatching
Which PHP versions fix PHP2Shell? Check vendor backports carefully
The PHP project lists PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 as the releases fixing CVE-2026-109618 and CVE-2026-109619. Linux distributions and long-term-support vendors may backport fixes into packages with different version labels. Confirm the exact vendor package advisory and deployed build; do not judge solely by the upstream version string.
Start with the PHP project's release list
PHP published security releases on October 21, 2026: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The project says PHP 8.1 and older no longer receive updates directly from PHP, while some distributions and LTS vendors provide backported fixes. The project's supported-versions page also shows branch support end dates, which matter when planning the next upgrade.
These upstream numbers are useful for installations built from PHP's own releases. They are not a universal comparison rule for packaged operating systems, managed hosting, or appliances.
What a backport changes
A backport applies a security fix to a vendor's maintained package branch without necessarily moving it to the newest upstream minor release. This can make a package version look older than the upstream fixed version while containing the patch. Conversely, a site's public X-Powered-By banner can be stale, customized, or omitted and cannot establish package contents.
Ask the host for the affected service or package name, vendor security advisory reference, package release/build identifier, and the date the web-serving runtime was restarted. For a containerized service, verify the image digest or build tag actually deployed, not just the new image built in a registry.
A useful confirmation
A strong response identifies the domain's serving environment, the provider's fixed package or supported runtime, and evidence that the affected service now uses it. If the provider cannot identify a fix for an unsupported branch, escalate to a supported runtime or a vendor-approved plan. PHP described temporary mitigations as incomplete; a configuration workaround should not be recorded as patch completion.
Keep a small evidence record: vendor name, package revision, advisory identifier, affected hostnames, install time and worker activation. That lets a reviewer distinguish a documented backport from a dashboard label and makes later maintenance easier when the provider changes its package scheme.
Common questions
Are the upstream build numbers the only patched builds?
No. They are PHP's listed fixed releases; distribution and LTS vendors may provide documented backports under different package revisions.
Is every lower version automatically vulnerable?
Do not conclude that from a banner alone. Check the exact vendor advisory and package serving the site.
What should an older-branch user do?
Ask the maintainer whether both CVE fixes were backported and plan a supported-branch upgrade when application compatibility allows.