CVE-2026-109618: is your PHP affected?
Out-of-memory handling can leave internal request data partly initialized; request cleanup may then treat it as valid, which can lead to remote code execution.
SeverityCritical9.2CVSS v4PHP Group (CNA)
Affected upstream versions
| Branch | Affected |
|---|---|
| 8.2 | 8.2.* < 8.2.35 |
| 8.3 | 8.3.* < 8.3.36 |
| 8.4 | 8.4.* < 8.4.27 |
| 8.5 | 8.5.* < 8.5.12 |
Fixed upstream
Linux packages and images
All fixed versionsRows with a fixed, not affected, waiting or fix pending state. Unconfirmed rows, end-of-life releases and third-party repositories are in the full table of php2shell.
Ubuntu
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| 26.10(stonking) | php8.5 | 8.5.9-0ubuntu2.1 | Fixed | USN-8948-1 | |
| 26.04 LTS(resolute) | php8.5 | 8.5.4-0ubuntu1.5 | Fixed | USN-8948-1 | |
| 24.04 LTS(noble) | php8.3 | 8.3.6-0ubuntu0.24.04.13 | Fixed | USN-8948-1 | |
| 22.04 LTS(jammy) | php8.1 | 8.1.2-1ubuntu2.28 | Fixed | USN-8948-1 | |
| 20.04 LTS(focal)Needs Ubuntu Pro | php7.4 | 7.4.3-4ubuntu2.29+esm5 | Fixed | USN-8948-2 | |
| 18.04 LTS(bionic)Needs Ubuntu Pro | php7.2 | 7.2.24-0ubuntu0.18.04.17+esm14 | Fixed | USN-8948-2 | |
| 16.04 LTS(xenial)Needs Ubuntu Pro (Legacy) | php7.0 | 7.0.33-0ubuntu0.16.04.16+esm22 | Fixed | USN-8948-2 | |
| 14.04 LTS(trusty)Needs Ubuntu Pro (Legacy) | php5 | 5.5.9+dfsg-1ubuntu4.29+esm18 | Fixed | USN-8948-2 |
Debian
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| 13(trixie) security | php8.4 | 8.4.27-1~deb13u1 | Fixed | DSA-6574-1 | |
| 12(bookworm) security (LTS team) | php8.2 | 8.2.35-1~deb12u1 | Fixed | DLA-4848-1 | |
| sid(unstable) | php8.4 | 8.4.27-1 | Fixed | Source |
Red Hat Enterprise Linux
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | php8.4 | 8.4.27-1.el10_2 | Fixed | RHSA-2026:87071 | |
| Red Hat Enterprise Linux 10 | php | 8.3.36-1.el10_2 | Fixed | RHSA-2026:87070 | |
| Red Hat Enterprise Linux 9 | php:8.4/php | No fixed version published yet | No fix yetBased only on the CVEs Red Hat has listed for this product | Source | |
| Red Hat Enterprise Linux 9 | php:8.3/php | 8.3.36-1.module+el9.8.0+25109+6886e21a | Fixed | RHSA-2026:87079 | |
| Red Hat Enterprise Linux 9 | php:8.2/php | 8.2.35-1.module+el9.8.0+25111+a1450321 | Fixed | RHSA-2026:87072 | |
| Red Hat Enterprise Linux 9 | php | 8.0.30-8.el9_8.1 | Fixed | RHSA-2026:87151 | |
| Red Hat Enterprise Linux 8 | php:8.2/php | 8.2.35-1.module+el8.10.0+25110+f67151d2 | Fixed | RHSA-2026:87073 | |
| Red Hat Enterprise Linux 8 | php:7.4/php | 7.4.33-8.module+el8.10.0+25117+30337cca | Fixed | RHSA-2026:87080 | |
| Red Hat Enterprise Linux 7 | php | No fixed version published yet | No fix yetBased only on the CVEs Red Hat has listed for this product | Source | |
| Red Hat Enterprise Linux 6 | php | No fixed version published yet | No fix yetBased only on the CVEs Red Hat has listed for this product | Source |
Rocky Linux
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| Rocky Linux 10 | php8.4 (AppStream) | 8.4.27-1.el10_2 | Fixed | RLSA-2026:87071 | |
| Rocky Linux 10 | php (AppStream) | 8.3.36-1.el10_2 | Fixed | RLSA-2026:87070 | |
| Rocky Linux 9 | php:8.3/php | 8.3.36-1.module+el9.8.0+40396+4e680bb7 | Fixed | RLSA-2026:87079 | |
| Rocky Linux 9 | php:8.2/php | 8.2.35-1.module+el9.8.0+40395+2f706e64 | Fixed | RLSA-2026:87072 | |
| Rocky Linux 9 | php (AppStream) | 8.0.30-8.el9_8.1 | Fixed | RLSA-2026:87151 | |
| Rocky Linux 8 | php:7.4/php | 7.4.33-8.module+el8.10.0+40393+c071e357 | Fixed | RLSA-2026:87080 |
Oracle Linux
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| Oracle Linux 10 | php8.4 | 8.4.27-1.el10_2 | Fixed | ELSA-2026-87071 | |
| Oracle Linux 10 | php | 8.3.36-1.el10_2 | Fixed | ELSA-2026-87070 | |
| Oracle Linux 9 | php | 8.0.30-8.el9_8.1 | Fixed | ELSA-2026-87151 |
Amazon Linux
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| Amazon Linux 2027 Preview | php8.5 | 8.5.12-1.amzn2027.0.1 | Fixed | ALAS2027-2026-243 | |
| Amazon Linux 2023 | php8.5 | 8.5.12-1.amzn2023.0.1 | Fixed | ALAS2023-2026-3304 | |
| Amazon Linux 2023 | php8.4 | 8.4.27-1.amzn2023.0.1 | Fixed | ALAS2023-2026-3303 | |
| Amazon Linux 2023 | php8.3 | 8.3.36-1.amzn2023.0.1 | Fixed | ALAS2023-2026-3302 | |
| Amazon Linux 2023 | php8.2 | 8.2.35-1.amzn2023.0.1 | Fixed | ALAS2023-2026-3301 | |
| Amazon Linux 2023 | php8.1 | No fixed version published yet | No fix yet | Source | |
| Amazon Linux 2(amazon-linux-extras php8.2) | php (amazon-linux-extras php8.2) | 8.2.35-1.amzn2.0.1 | Fixed | ALAS2PHP8.2-2026-015 | |
| Amazon Linux 2 | php (AL2 core repository) | No fixed version published yet | No fix yet | Source |
Alpine Linux
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| edge(development) | php85 | 8.5.12-r0 | Fixed | GHSA-w8hw-w9fx-j79w | |
| edge(development) | php84 | 8.4.27-r0 | Fixed | GHSA-w8hw-w9fx-j79w | |
| edge(development) | php83 | 8.3.36-r0 | Fixed | GHSA-w8hw-w9fx-j79w | |
| Alpine 3.24 | php85 | 8.5.12-r0 | Fixed | GHSA-w8hw-w9fx-j79w | |
| Alpine 3.24 | php84 | 8.4.27-r0 | Fixed | GHSA-w8hw-w9fx-j79w | |
| Alpine 3.24 | php83 | 8.3.36-r0 | Fixed | GHSA-w8hw-w9fx-j79w |
Docker official images
Windows builds
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| Windows binaries(windows.php.net) | php-8.5.12-Win32-vs17-x64.zip | 8.5.12 | Fixed | Source | |
| Windows binaries(windows.php.net) | php-8.4.27-Win32-vs17-x64.zip | 8.4.27 | Fixed | Source | |
| Windows binaries(windows.php.net) | php-8.3.36-Win32-vs16-x64.zip | 8.3.36 | Fixed | Source | |
| Windows binaries(windows.php.net) | php-8.2.35-Win32-vs16-x64.zip | 8.2.35 | Fixed | Source |
Homebrew
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| Homebrew formulae(macOS and Linux) | php | 8.5.12 | Fixed | Source | |
| Homebrew formulae(macOS and Linux) | php@8.4 | 8.4.27 | Fixed | Source | |
| Homebrew formulae(macOS and Linux) | php@8.3 | 8.3.36 | Fixed | Source | |
| Homebrew formulae(macOS and Linux) | php@8.2 | 8.2.35 | Fixed | Source |
XAMPP
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| XAMPP(Apache Friends) download page | XAMPP for Windows/Linux installers: PHP 8.0.30, 8.1.25, 8.2.12 | No fixed version published yet | No fix yet | Source |
CISA Known Exploited Vulnerabilities (KEV)
Not in the KEV catalog as of catalog version 2026.10.21, checked . KEV catalog
How to check your system
Find the version you run: the upstream release for a source or vendor build, or the package version for a distribution package.
Compare it with the row for your own release line or distribution above. A distribution package is judged by its own version string, never by the upstream number.
Or paste the output into the version checker. It runs in your browser and sends nothing.
Hosting providers, platform guides and the change log are on the page for php2shell.
Sources
- CVE record · CVE Program
- GitHub security advisory · github.com
- Upstream release or advisory · PHP Group · Last checked
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.
- Upstream release or advisory · PHP Group · Last checked
- Upstream release or advisory · PHP Group · Last checked
- Upstream release or advisory · PHP Group · Last checked
- KEV catalog · CISA · Last checked