English
English 日本語
Get a fix plan
Menu

Projects

Apache HTTP ServerApache Log4jnginxOpenSSLPHPApache TomcatWordPressAll projectsStatusAlerts (soon)Method Get a fix plan
Data checked 1 open event tracked Official sources only

CVE-2026-109619: is your PHP affected?

Request-owned internal state can survive after its memory is freed, and a later request handled by the same worker may use it before normal initialization, which can lead to remote code execution.

Last checked Published Assigned by PHP Group

Listed in php2shell.

SeverityCritical9.2CVSS v4PHP Group (CNA)

Affected upstream versions

Affected upstream version ranges by release line
BranchAffected
8.2 8.2.* < 8.2.35
8.3 8.3.* < 8.3.36
8.4 8.4.* < 8.4.27
8.5 8.5.* < 8.5.12

Fixed upstream

Upstream fixed releases by release line
BranchFixed inReleasedState
8.5 8.5.12 Fixed
8.4 8.4.27 Fixed
8.3 8.3.36 Fixed
8.2 8.2.35 Fixed

Linux packages and images

All fixed versions

Rows with a fixed, not affected, waiting or fix pending state. Unconfirmed rows, end-of-life releases and third-party repositories are in the full table of php2shell.

Ubuntu

Ubuntu
ReleasePackageFixed versionStateVerifiedSource
26.10(stonking) php8.5 8.5.9-0ubuntu2.1 Fixed USN-8948-1
26.04 LTS(resolute) php8.5 8.5.4-0ubuntu1.5 Fixed USN-8948-1
24.04 LTS(noble) php8.3 8.3.6-0ubuntu0.24.04.13 Fixed USN-8948-1
22.04 LTS(jammy) php8.1 8.1.2-1ubuntu2.28 Fixed USN-8948-1
20.04 LTS(focal)Needs Ubuntu Pro php7.4 7.4.3-4ubuntu2.29+esm5 Fixed USN-8948-2
18.04 LTS(bionic)Needs Ubuntu Pro php7.2 7.2.24-0ubuntu0.18.04.17+esm14 Fixed USN-8948-2
16.04 LTS(xenial)Needs Ubuntu Pro (Legacy) php7.0 7.0.33-0ubuntu0.16.04.16+esm22 Fixed USN-8948-2
14.04 LTS(trusty)Needs Ubuntu Pro (Legacy) php5 5.5.9+dfsg-1ubuntu4.29+esm18 Fixed USN-8948-2

Debian

Debian
ReleasePackageFixed versionStateVerifiedSource
13(trixie) security php8.4 8.4.27-1~deb13u1 Fixed DSA-6574-1
12(bookworm) security (LTS team) php8.2 8.2.35-1~deb12u1 Fixed DLA-4848-1
forky(testing) php8.4 No fixed version published yet No fix yet Source

Red Hat Enterprise Linux

Red Hat Enterprise Linux
ReleasePackageFixed versionStateVerifiedSource
Red Hat Enterprise Linux 7 php No fixed version published yet No fix yetBased only on the CVEs Red Hat has listed for this product Source
Red Hat Enterprise Linux 6 php No fixed version published yet No fix yetBased only on the CVEs Red Hat has listed for this product Source

Rocky Linux

Rocky Linux
ReleasePackageFixed versionStateVerifiedSource
Rocky Linux 10 php8.4 (AppStream) 8.4.27-1.el10_2 Fixed RLSA-2026:87071
Rocky Linux 10 php (AppStream) 8.3.36-1.el10_2 Fixed RLSA-2026:87070
Rocky Linux 9 php:8.3/php 8.3.36-1.module+el9.8.0+40396+4e680bb7 Fixed RLSA-2026:87079
Rocky Linux 9 php:8.2/php 8.2.35-1.module+el9.8.0+40395+2f706e64 Fixed RLSA-2026:87072
Rocky Linux 9 php (AppStream) 8.0.30-8.el9_8.1 Fixed RLSA-2026:87151
Rocky Linux 8 php:7.4/php 7.4.33-8.module+el8.10.0+40393+c071e357 Fixed RLSA-2026:87080

Oracle Linux

Oracle Linux
ReleasePackageFixed versionStateVerifiedSource
Oracle Linux 10 php8.4 8.4.27-1.el10_2 Fixed ELSA-2026-87071
Oracle Linux 10 php 8.3.36-1.el10_2 Fixed ELSA-2026-87070
Oracle Linux 9 php 8.0.30-8.el9_8.1 Fixed ELSA-2026-87151

Amazon Linux

Amazon Linux
ReleasePackageFixed versionStateVerifiedSource
Amazon Linux 2027 Preview php8.5 8.5.12-1.amzn2027.0.1 Fixed ALAS2027-2026-243
Amazon Linux 2023 php8.5 8.5.12-1.amzn2023.0.1 Fixed ALAS2023-2026-3304
Amazon Linux 2023 php8.4 8.4.27-1.amzn2023.0.1 Fixed ALAS2023-2026-3303
Amazon Linux 2023 php8.3 8.3.36-1.amzn2023.0.1 Fixed ALAS2023-2026-3302
Amazon Linux 2023 php8.2 8.2.35-1.amzn2023.0.1 Fixed ALAS2023-2026-3301
Amazon Linux 2(amazon-linux-extras php8.2) php (amazon-linux-extras php8.2) 8.2.35-1.amzn2.0.1 Fixed ALAS2PHP8.2-2026-015

Alpine Linux

Alpine Linux
ReleasePackageFixed versionStateVerifiedSource
edge(development) php85 8.5.12-r0 Fixed GHSA-w8hw-w9fx-j79w
edge(development) php84 8.4.27-r0 Fixed GHSA-w8hw-w9fx-j79w
edge(development) php83 8.3.36-r0 Fixed GHSA-w8hw-w9fx-j79w
Alpine 3.24 php85 8.5.12-r0 Fixed GHSA-w8hw-w9fx-j79w
Alpine 3.24 php84 8.4.27-r0 Fixed GHSA-w8hw-w9fx-j79w
Alpine 3.24 php83 8.3.36-r0 Fixed GHSA-w8hw-w9fx-j79w

Docker official images

Docker official images
ReleasePackageFixed versionStateVerifiedSource
Docker Official Image 'php' php:8.5 8.5.12 Fixed Source
Docker Official Image 'php' php:8.4 8.4.27 Fixed Source
Docker Official Image 'php' php:8.3 8.3.36 Fixed Source
Docker Official Image 'php' php:8.2 8.2.35 Fixed Source

Windows builds

Windows builds
ReleasePackageFixed versionStateVerifiedSource
Windows binaries(windows.php.net) php-8.5.12-Win32-vs17-x64.zip 8.5.12 Fixed Source
Windows binaries(windows.php.net) php-8.4.27-Win32-vs17-x64.zip 8.4.27 Fixed Source
Windows binaries(windows.php.net) php-8.3.36-Win32-vs16-x64.zip 8.3.36 Fixed Source
Windows binaries(windows.php.net) php-8.2.35-Win32-vs16-x64.zip 8.2.35 Fixed Source

Homebrew

Homebrew
ReleasePackageFixed versionStateVerifiedSource
Homebrew formulae(macOS and Linux) php 8.5.12 Fixed Source
Homebrew formulae(macOS and Linux) php@8.4 8.4.27 Fixed Source
Homebrew formulae(macOS and Linux) php@8.3 8.3.36 Fixed Source
Homebrew formulae(macOS and Linux) php@8.2 8.2.35 Fixed Source

XAMPP

XAMPP
ReleasePackageFixed versionStateVerifiedSource
XAMPP(Apache Friends) download page XAMPP for Windows/Linux installers: PHP 8.0.30, 8.1.25, 8.2.12 No fixed version published yet No fix yet Source

CISA Known Exploited Vulnerabilities (KEV)

Not in the KEV catalog as of catalog version 2026.10.21, checked . KEV catalog

How to check your system

  1. Find the version you run: the upstream release for a source or vendor build, or the package version for a distribution package.

  2. Compare it with the row for your own release line or distribution above. A distribution package is judged by its own version string, never by the upstream number.

  3. Or paste the output into the version checker. It runs in your browser and sends nothing.

    Check your version

Hosting providers, platform guides and the change log are on the page for php2shell.

Sources