php2shell: change log
-
Amazon published a fixed php8.5 package for the Amazon Linux 2027 Preview: 8.5.12-1.amzn2027.0.1 (ALAS2027-2026-243).
-
Hostnet says the PHP security update is rolled out on all of its systems, including older PHP versions via PHP Extended Support, and has lifted its temporary measures.
-
Hetzner says it has also deployed patches for PHP 5.6 and 7.3 on all Webhosting and Managed Servers, after PHP 7.4 and 8.0 to 8.5.
-
Upsun says the PHP security patch has finished deploying to all Dedicated clusters, after updated images reached all grid regions.
-
CPI says it is urgently applying the latest PHP patches on the versions that have one, and will post an update on versions without a patch.
-
Red Hat's CVE pages now list fixed packages. RHEL 10: php 8.3.36-1.el10_2 (RHSA-2026:87070) and php8.4 8.4.27-1.el10_2 (RHSA-2026:87071). RHEL 9: php 8.0.30-8.el9_8.1 (RHSA-2026:87151), php:8.2 (RHSA-2026:87072) and php:8.3 (RHSA-2026:87079). RHEL 8: php:8.2 (RHSA-2026:87073), after php:7.4 (RHSA-2026:87080). RHEL 9 php:8.4 is still listed as Affected with no advisory, and RHEL 7 as 'Under investigation' for CVE-2026-109618 and 'Not affected' for CVE-2026-109619.
-
Rocky Linux published fixed PHP packages. Rocky Linux 10: php 8.3.36-1.el10_2 (RLSA-2026:87070) and php8.4 8.4.27-1.el10_2 (RLSA-2026:87071). Rocky Linux 9: php 8.0.30-8.el9_8.1 (RLSA-2026:87151), php:8.2 (RLSA-2026:87072) and php:8.3 (RLSA-2026:87079). Rocky Linux 8: php:7.4 (RLSA-2026:87080). There is no advisory yet for Rocky Linux 9 php:8.4 or Rocky Linux 8 php:8.2.
-
Oracle's CVE pages list errata for Oracle Linux 10 (ELSA-2026-87070 php 8.3.36-1.el10_2 and ELSA-2026-87071 php8.4 8.4.27-1.el10_2) and Oracle Linux 9 (ELSA-2026-87151 php 8.0.30-8.el9_8.1). They list no php module stream for Oracle Linux 9 and no entry yet for Oracle Linux 8.
-
Amazon Linux 2023: ALAS2023-2026-3301 to ALAS2023-2026-3304 list fixed packages for php8.2 (8.2.35-1.amzn2023.0.1), php8.3 (8.3.36-1.amzn2023.0.1), php8.4 (8.4.27-1.amzn2023.0.1) and php8.5 (8.5.12-1.amzn2023.0.1).
-
Amazon Linux 2: ALAS2PHP8.2-2026-015 lists the fixed php 8.2.35-1.amzn2.0.1 packages for the amazon-linux-extras php8.2 stream.
-
Amazon's CVE pages list php8.1 on Amazon Linux 2023 and the Amazon Linux 2 core php package as 'No Fix Planned'; no fixed package is shown for either.
-
Alpine edge: php83 8.3.36-r0, php84 8.4.27-r0 and php85 8.5.12-r0 are now in the x86_64 community package index. Not every architecture is updated yet (x86, ppc64le, s390x and riscv64 still listed older builds at our check).
-
Debian's security tracker lists php8.4 8.4.27-1 as the fix in unstable (sid) for both CVEs. Testing (forky) still has php8.4 8.4.26-1, which the tracker marks vulnerable.
-
Debian 11 (bullseye): Debian itself has no php7.4 entry for these CVEs because Long Term Support ended on 31 August 2026. Freexian's paid Extended LTS service lists 7.4.33-1+deb11u14 (ELA-1853-1), available only to its subscribers.
-
Remi's repository (third-party) has PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 builds for Enterprise Linux 10, dated 21 October. Remi does not name the CVEs; these are the upstream fixed versions.
-
Remi's repository (third-party) has PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 builds for Enterprise Linux 9, dated 21 October. Remi does not name the CVEs; these are the upstream fixed versions.
-
Remi's repository (third-party) has PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 builds for Enterprise Linux 8, dated 21 October. Remi does not name the CVEs; these are the upstream fixed versions.
-
JVN (JPCERT/CC and IPA) published vulnerability note JVNVU#99905564 for both CVEs. It points to the PHP Group advisory and does not name fixed versions itself.
-
The Canadian Centre for Cyber Security published alert AL26-026 listing the fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It says a proof of concept is reported in open sources and that it has identified no active exploitation at this time.
-
The PHP Foundation says proof-of-concept code circulated more widely on 21 October, and that its security team did not identify any functional exploits at the time of release.
-
GoDaddy says Managed Hosting for WordPress is fully patched and needs no action. Web Hosting and Windows Hosting are mitigated while it waits for patched packages from its vendor, and VPS owners must update PHP themselves.
-
WP Engine says it has finished deploying the PHP security patches on its platform and no action is needed (updated builds named: 7.4.33.17, 8.2.35, 8.4.27 and 8.5.12).
-
Cloudways says patches are applied for all customer applications on its Autonomous product and are still rolling out for applications on Flexible.
-
Liquid Web published its patched build numbers (cPanel PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and Plesk v18.0.81.4) and says patched builds are still being deployed across its infrastructure. Customers who are not patched yet should run a package update in their control panel.
-
DigitalOcean says the App Platform PHP buildpack is patched. You must redeploy your app to pick it up, and apps built from your own Dockerfile or image need PHP updated in that image.
-
AWS Elastic Beanstalk released Amazon Linux 2023 PHP 8.5 and PHP 8.4 platform versions (4.13.13) with PHP 8.5.12 and 8.4.27. A later release is to update the PHP 8.3 and PHP 8.2 platform branches.
-
AWS published Lightsail guidance for updating PHP yourself. Instances from Lightsail-packaged blueprints update PHP with the package manager; Bitnami-blueprint instances keep their own copy of PHP that apt upgrade does not update. AWS lists the fixed versions as 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
-
netcup says all Webhosting packages (including Reseller) and all Managed Servers are patched and online. Root server, VPS and managed cloud cluster customers must patch PHP themselves.
-
CloudLinux says its release of fixed alt-php packages is complete (22 October, 00:07 UTC) and a regular update installs them, followed by a PHP restart. The packages carry the fix as a backport and keep their own lower version numbers, so check the package changelog.
-
Plesk says its own interface engine (sw-engine) is fixed in Plesk Obsidian 18.0.80 Update 11 and 18.0.81 Update 4, and asks customers to update Plesk to the latest available version.
-
aaPanel now says patches are available in its App Store for PHP 7.4 to 8.5; update each installed PHP version there. Users on PHP 7.3 or older are pointed to configuration mitigation only.
-
Sakura Internet says the fix is complete for every PHP version selectable in the Rental Server and Managed Server control panel. phpMyAdmin and webmail used by some services are still being handled.
-
GMO Pepabo says on its official X account that Lolipop has the fixed version applied and customer sites were restored at 13:11 JST on 22 October. It also applied its own fixes to older PHP versions that have no official fix.
-
GMO Pepabo says heteml has the official fixed versions for the PHP 8 series and PHP 7.4, and its own fix for all other versions. Some functions are disabled on PHP 8.1 and below.
-
ColorfulBox says the security fix is complete on all its servers as of the morning of 22 October, and customers do not need to change their PHP version.
-
mixhost says it finished applying the PHP fix packages on all its rental servers at about 10:18 JST on 22 October (PHP 5.2 to 8.5). The PHP version number shown does not change, and no customer action is needed.
-
ConoHa says it is applying security patches to ConoHa WING servers in sequence and keeping each customer's current PHP version.
-
GMO Internet says it is applying security patches to Onamae.com Rental Server servers in sequence and keeping each customer's current PHP version. A change may be needed for some customers on PHP 5.x or 7.x.
-
Value Domain's status page says the fix is complete on CORESERVER V2 for every PHP version it offers, and on CORESERVER V1 for PHP 7.4 and later. Older PHP versions on V1 are not mentioned.
-
Value Domain's status page says the fix is complete on XREA for PHP 7.4 and later. Older PHP versions are not mentioned.
-
Value Domain's status page says the fix is complete on VALUESERVER for PHP 7.4 and later. Older PHP versions are not mentioned.
-
Value Domain's status page says the fix is complete on One Rental Server for PHP 8.0 and later. Older PHP versions are not mentioned.
-
NTTPC published a notice for WebARENA SuiteX naming both CVEs. Web access from outside Japan is restricted and one PHP function (file-upload progress) is disabled as mitigations; the notice does not say a PHP fix has been applied.
-
Disclosed in the CVE record published by the PHP Group.
-
AWS (Amazon Threat Intelligence) says php2shell is now being broadly exploited in the wild, and that its honeypot sensors recorded an exploitation attempt dated 17 Oct, four days before disclosure. AWS adds that it is unclear whether those attempts succeeded on real systems. CISA's KEV catalog does not list either CVE as of 22 Oct.
-
Red Hat released RHSA-2026:87080 for RHEL 8 php:7.4 (7.4.33-8.module+el8.10.0+25117+30337cca), which fixes both CVEs.
-
Alpine 3.24: php83 8.3.36-r0, php84 8.4.27-r0 and php85 8.5.12-r0 are now in the x86_64 community repository. On Alpine edge, php83 8.3.36-r0 is listed in the security database but the package is not in the repository yet.
-
Homebrew: php is now 8.5.12, php@8.4 is 8.4.27, php@8.3 is 8.3.36 and php@8.2 is 8.2.35.
-
NVD added its own CVSS 3.1 score of 9.8 (Critical) for both CVEs, and its affected-version data now also covers PHP versions older than 8.2.35.
-
Laravel Cloud says every running application is now patched (PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35).
-
Hetzner says PHP 7.4 and 8.0 to 8.5 are patched on all Webhosting and Managed Servers.
-
OVHcloud says PHP 7.4 to 8.5 are patched on all Web Hosting clusters.
-
Flywheel says patching of its platform is finished and no customer action is needed.
-
Azure App Service finished rolling out patched PHP images to the Latest and Standard channels (8.2.35, 8.3.36, 8.4.27, 8.5.12).
-
Plesk now has PHP 8.2 to 8.5 fixes for Windows too, and says rebuilt 7.4, 8.0 and 8.1 packages on Linux include the fix.
-
DirectAdmin released a further build with patches for PHP 7.3 down to 5.6.
-
CloudLinux released more fixed alt-php builds (alt-php74, alt-php80 and alt-php81 on more platforms); other versions are still in preparation.
-
Webuzo published patched EMPS packages and tells users to run the EMPS update command. CyberPanel says fixed LiteSpeed PHP packages (8.2.35, 8.3.36, 8.4.27, 8.5.12) are available and administrators must update.
-
Hosting status: Hostinger, Kinsta, Upsun and Infomaniak now report that patched PHP is being rolled out.
-
Hosting status: new progress updates from Namecheap, Pantheon, netcup, Xserver, Liquid Web, WP Engine, Cloudways, Wordfence and Virtualmin.
-
Site launched with the version checker, the fixed-version table for Linux distributions, Docker and other platforms, and the hosting status table.
-
Debian's security tracker lists fixed php8.4 packages for Debian 13 (DSA-6574-1) and php8.2 packages for Debian 12 (DLA-4848-1).
-
The official Docker php images were rebuilt with PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
-
Ubuntu published USN-8948-1 and USN-8948-2 with fixed PHP packages (Ubuntu 20.04 and older through Ubuntu Pro).
-
php.net released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix CVE-2026-109618 and CVE-2026-109619.