English
English 日本語
Get a fix plan
Menu

Projects

Apache HTTP ServernginxOpenSSLPHPApache TomcatAll projectsStatusAlerts (soon)Method Get a fix plan

Is your PHP affected by php2shell?

Two critical PHP flaws can allow unauthenticated remote code execution.

Last checked Last changed

Not re-checked since the time above. Check the official source below.

A newer official update is being verified.

Exploited, reported by AWSExploit demonstratedPHP Group (php.net)

Am I affected?

If you run PHP below the fixed release for your branch, update it.

Check your version

Runs in your browser. Nothing is sent.

Fixed upstream

Upstream fixed releases by release line
BranchFixed inReleasedState
8.5 8.5.12 Fixed
8.4 8.4.27 Fixed
8.3 8.3.36 Fixed
8.2 8.2.35 Fixed

End-of-life branches

  • End of life 8.1 No official release. Source patch only. Source
  • End of life 8.0 No official release. Source patch only. Source
  • End of life 7.4 No official release. Source patch only. Source
  • End of life Branches older than 7.4 Source

Pre-release 8.6 8.6.0 RC4

Linux packages and images

43 of 63 tracked Linux packages and images have the fix.

All fixed versions
Linux distributions: fixed packages by vendor
DistributionFixedWaitingUnconfirmedState
Ubuntu 8 / 8 0 0 Fixed
Debian 3 / 5 1 1 Needs attention
Red Hat Enterprise Linux 7 / 12 3 2 Needs attention
AlmaLinux 0 / 3 0 3 Unconfirmed
Rocky Linux 6 / 11 0 5 Unconfirmed
Oracle Linux 3 / 6 0 3 Unconfirmed
Amazon Linux 6 / 8 2 0 Needs attention
Alpine Linux 6 / 6 0 0 Fixed
Docker official images 4 / 4 0 0 Fixed
Windows builds 4 / 4 0 0 Fixed
Homebrew 4 / 4 0 0 Fixed
XAMPP 0 / 1 1 0 Needs attention

Hosting providers

13 of 70 hosting providers say they have patched.

All hosting providers
Hosting providers: patch status
ProviderRegionStateSource
SiteGround Global Mitigation only Source
Hostinger Global Rolling out Source
Bluehost Global Rolling out Source
GoDaddy Global Rolling out Source
HostGator Global Rolling out Source
DreamHost Global Rolling out Source

First 6 of 70 providers shown.

Confirm it worked

  1. Find the version you run. Use the command, or read it in your hosting control panel.

    $ php -v

  2. Compare it with the row for your own release line or distro above. Only compare a distro package with that distro's own row.

  3. Or paste it into the checker. It runs in your browser and sends nothing.

    Check your version

Questions people ask

My server shows an older version number than the fixed one. Am I still exposed?

Not necessarily. Linux distributions fix a problem inside their own package and keep their own numbering. Read the row for your distribution and release in the table, not the upstream number.

What does "One official source so far" mean?

PatchBell publishes a fixed state only when two independent official sources agree. A row with one source stays unconfirmed until a second one confirms it.

Does PatchBell scan my server?

No. Nothing here contacts your server or your site. The checker compares what you paste with the published data in your browser.

My hosting provider is not listed. What now?

Ask the provider which version your plan runs, then compare it with the table. A missing provider means PatchBell has no official statement from it, not that the plan is fixed.

Sources