php2shell: fixed versions by distro
Every tracked distribution release and image, with the package version that counts as fixed and the vendor's own page.
- Overall
- Partly fixed
- Severity
Critical9.2CVSS v4PHP Group (CNA)
- Last checked
Ubuntu
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| 26.10(stonking) | php8.5 | 8.5.9-0ubuntu2.1 | Fixed | USN-8948-1 | |
| 26.04 LTS(resolute) | php8.5 | 8.5.4-0ubuntu1.5 | Fixed | USN-8948-1 | |
| 25.10(questing) | php | No fixed version published yet | End of life | Source | |
| 25.04(plucky) | php | No fixed version published yet | End of life | Source | |
| 24.04 LTS(noble) | php8.3 | 8.3.6-0ubuntu0.24.04.13 | Fixed | USN-8948-1 | |
| 22.04 LTS(jammy) | php8.1 | 8.1.2-1ubuntu2.28 | Fixed | USN-8948-1 | |
| 20.04 LTS(focal)Needs Ubuntu Pro | php7.4 | 7.4.3-4ubuntu2.29+esm5 | Fixed | USN-8948-2 | |
| 18.04 LTS(bionic)Needs Ubuntu Pro | php7.2 | 7.2.24-0ubuntu0.18.04.17+esm14 | Fixed | USN-8948-2 | |
| 16.04 LTS(xenial)Needs Ubuntu Pro (Legacy) | php7.0 | 7.0.33-0ubuntu0.16.04.16+esm22 | Fixed | USN-8948-2 | |
| 14.04 LTS(trusty)Needs Ubuntu Pro (Legacy) | php5 | 5.5.9+dfsg-1ubuntu4.29+esm18 | Fixed | USN-8948-2 |
Debian
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| 13(trixie) security | php8.4 | 8.4.27-1~deb13u1 | Fixed | DSA-6574-1 | |
| 12(bookworm) security (LTS team) | php8.2 | 8.2.35-1~deb12u1 | Fixed | DLA-4848-1 | |
| 11(bullseye) ELTS (Freexian Extended LTS) | php7.4 | We could not confirm it | Unconfirmed | Source | |
| forky(testing) | php8.4 | No fixed version published yet | No fix yet | Source | |
| sid(unstable) | php8.4 | 8.4.27-1 | Fixed | Source |
Red Hat Enterprise Linux
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | php | We could not confirm it | Unconfirmed | Source | |
| Red Hat Enterprise Linux 10 | php8.4 | 8.4.27-1.el10_2 | Fixed | RHSA-2026:87071 | |
| Red Hat Enterprise Linux 10 | php | 8.3.36-1.el10_2 | Fixed | RHSA-2026:87070 | |
| Red Hat Enterprise Linux 9 | php | We could not confirm it | Unconfirmed | Source | |
| Red Hat Enterprise Linux 9 | php:8.4/php | No fixed version published yet | No fix yet | Source | |
| Red Hat Enterprise Linux 9 | php:8.3/php | 8.3.36-1.module+el9.8.0+25109+6886e21a | Fixed | RHSA-2026:87079 | |
| Red Hat Enterprise Linux 9 | php:8.2/php | 8.2.35-1.module+el9.8.0+25111+a1450321 | Fixed | RHSA-2026:87072 | |
| Red Hat Enterprise Linux 9 | php | 8.0.30-8.el9_8.1 | Fixed | RHSA-2026:87151 | |
| Red Hat Enterprise Linux 8 | php:8.2/php | 8.2.35-1.module+el8.10.0+25110+f67151d2 | Fixed | RHSA-2026:87073 | |
| Red Hat Enterprise Linux 8 | php:7.4/php | 7.4.33-8.module+el8.10.0+25117+30337cca | Fixed | RHSA-2026:87080 | |
| Red Hat Enterprise Linux 7 | php | No fixed version published yet | No fix yet | Source | |
| Red Hat Enterprise Linux 6 | php | No fixed version published yet | No fix yet | Source |
AlmaLinux
Rocky Linux
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| Rocky Linux 10 | php (AppStream) | We could not confirm it | Unconfirmed | Source | |
| Rocky Linux 10 | php8.4 (AppStream) | 8.4.27-1.el10_2 | Fixed | RLSA-2026:87071 | |
| Rocky Linux 10 | php (AppStream) | 8.3.36-1.el10_2 | Fixed | RLSA-2026:87070 | |
| Rocky Linux 9 | php (AppStream) | We could not confirm it | Unconfirmed | Source | |
| Rocky Linux 9 | php:8.4/php | We could not confirm it | Unconfirmed | Source | |
| Rocky Linux 9 | php:8.3/php | 8.3.36-1.module+el9.8.0+40396+4e680bb7 | Fixed | RLSA-2026:87079 | |
| Rocky Linux 9 | php:8.2/php | 8.2.35-1.module+el9.8.0+40395+2f706e64 | Fixed | RLSA-2026:87072 | |
| Rocky Linux 9 | php (AppStream) | 8.0.30-8.el9_8.1 | Fixed | RLSA-2026:87151 | |
| Rocky Linux 8 | php (AppStream) | We could not confirm it | Unconfirmed | Source | |
| Rocky Linux 8 | php:8.2/php | We could not confirm it | Unconfirmed | Source | |
| Rocky Linux 8 | php:7.4/php | 7.4.33-8.module+el8.10.0+40393+c071e357 | Fixed | RLSA-2026:87080 |
Oracle Linux
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| Oracle Linux 10 | php | We could not confirm it | Unconfirmed | Source | |
| Oracle Linux 10 | php8.4 | 8.4.27-1.el10_2 | Fixed | ELSA-2026-87071 | |
| Oracle Linux 10 | php | 8.3.36-1.el10_2 | Fixed | ELSA-2026-87070 | |
| Oracle Linux 9 | php | We could not confirm it | Unconfirmed | Source | |
| Oracle Linux 9 | php | 8.0.30-8.el9_8.1 | Fixed | ELSA-2026-87151 | |
| Oracle Linux 8 | php | We could not confirm it | Unconfirmed | Source |
Amazon Linux
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| Amazon Linux 2027 Preview | php8.5 | 8.5.12-1.amzn2027.0.1 | Fixed | ALAS2027-2026-243 | |
| Amazon Linux 2023 | php8.5 | 8.5.12-1.amzn2023.0.1 | Fixed | ALAS2023-2026-3304 | |
| Amazon Linux 2023 | php8.4 | 8.4.27-1.amzn2023.0.1 | Fixed | ALAS2023-2026-3303 | |
| Amazon Linux 2023 | php8.3 | 8.3.36-1.amzn2023.0.1 | Fixed | ALAS2023-2026-3302 | |
| Amazon Linux 2023 | php8.2 | 8.2.35-1.amzn2023.0.1 | Fixed | ALAS2023-2026-3301 | |
| Amazon Linux 2023 | php8.1 | No fixed version published yet | No fix yet | Source | |
| Amazon Linux 2(amazon-linux-extras php8.2) | php (amazon-linux-extras php8.2) | 8.2.35-1.amzn2.0.1 | Fixed | ALAS2PHP8.2-2026-015 | |
| Amazon Linux 2 | php (AL2 core repository) | No fixed version published yet | No fix yet | Source |
Alpine Linux
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| edge(development) | php85 | 8.5.12-r0 | Fixed | GHSA-w8hw-w9fx-j79w | |
| edge(development) | php84 | 8.4.27-r0 | Fixed | GHSA-w8hw-w9fx-j79w | |
| edge(development) | php83 | 8.3.36-r0 | Fixed | GHSA-w8hw-w9fx-j79w | |
| Alpine 3.24 | php85 | 8.5.12-r0 | Fixed | GHSA-w8hw-w9fx-j79w | |
| Alpine 3.24 | php84 | 8.4.27-r0 | Fixed | GHSA-w8hw-w9fx-j79w | |
| Alpine 3.24 | php83 | 8.3.36-r0 | Fixed | GHSA-w8hw-w9fx-j79w | |
| Alpine 3.23 | php85 | No fixed version published yet | End of life | Source | |
| Alpine 3.23 | php84 | No fixed version published yet | End of life | Source | |
| Alpine 3.23 | php83 | No fixed version published yet | End of life | Source | |
| Alpine 3.22 | php84 | No fixed version published yet | End of life | Source | |
| Alpine 3.22 | php83 | No fixed version published yet | End of life | Source | |
| Alpine 3.22 | php82 | No fixed version published yet | End of life | Source | |
| Alpine 3.21 | php84 | No fixed version published yet | End of life | Source | |
| Alpine 3.21 | php83 | No fixed version published yet | End of life | Source | |
| Alpine 3.21 | php82 | No fixed version published yet | End of life | Source | |
| Alpine 3.20 | php83 | No fixed version published yet | End of life | Source | |
| Alpine 3.20 | php82 | No fixed version published yet | End of life | Source | |
| Alpine 3.19 | php83 | No fixed version published yet | End of life | Source | |
| Alpine 3.19 | php82 | No fixed version published yet | End of life | Source | |
| Alpine 3.19 | php81 | No fixed version published yet | End of life | Source |
Docker official images
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| Docker Official Image 'php' | php:8.5 | 8.5.12 | Fixed | Source | |
| Docker Official Image 'php' | php:8.4 | 8.4.27 | Fixed | Source | |
| Docker Official Image 'php' | php:8.3 | 8.3.36 | Fixed | Source | |
| Docker Official Image 'php' | php:8.2 | 8.2.35 | Fixed | Source | |
| Docker Official Image 'php' | php:8.1 | No fixed version published yet | End of life | Source | |
| Docker Official Image 'php' | php:8.0 | No fixed version published yet | End of life | Source | |
| Docker Official Image 'php' | php:7.4 | No fixed version published yet | End of life | Source |
Windows builds
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| Windows binaries(windows.php.net) | php-8.5.12-Win32-vs17-x64.zip | 8.5.12 | Fixed | Source | |
| Windows binaries(windows.php.net) | php-8.4.27-Win32-vs17-x64.zip | 8.4.27 | Fixed | Source | |
| Windows binaries(windows.php.net) | php-8.3.36-Win32-vs16-x64.zip | 8.3.36 | Fixed | Source | |
| Windows binaries(windows.php.net) | php-8.2.35-Win32-vs16-x64.zip | 8.2.35 | Fixed | Source | |
| Windows binaries(windows.php.net) | php-8.1.34-Win32 (latest listed) | No fixed version published yet | End of life | Source | |
| Windows binaries(windows.php.net) | php-8.0.30-Win32 (latest listed) | No fixed version published yet | End of life | Source | |
| Windows binaries(windows.php.net) | php-7.4.33-Win32 (latest listed) | No fixed version published yet | End of life | Source |
Homebrew
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| Homebrew formulae(macOS and Linux) | php | 8.5.12 | Fixed | Source | |
| Homebrew formulae(macOS and Linux) | php@8.4 | 8.4.27 | Fixed | Source | |
| Homebrew formulae(macOS and Linux) | php@8.3 | 8.3.36 | Fixed | Source | |
| Homebrew formulae(macOS and Linux) | php@8.2 | 8.2.35 | Fixed | Source | |
| Homebrew formulae(macOS and Linux) | php@8.1 | No fixed version published yet | End of life | Source |
XAMPP
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| XAMPP(Apache Friends) download page | XAMPP for Windows/Linux installers: PHP 8.0.30, 8.1.25, 8.2.12 | No fixed version published yet | No fix yet | Source |
Third-party repositories
Volunteer repositories, not the vendor. Listed separately and never counted.
Ondřej Surý PPA
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| 24.04 LTS(noble) - ppa:ondrej/php | php8.5 | 8.5.12-1+ubuntu24.04.1+deb.sury.org+1 | Fixed | Source | |
| 24.04 LTS(noble) - ppa:ondrej/php | php8.4 | 8.4.27-1+ubuntu24.04.1+deb.sury.org+1 | Fixed | Source | |
| 24.04 LTS(noble) - ppa:ondrej/php | php8.3 | 8.3.36-1+ubuntu24.04.1+deb.sury.org+1 | Fixed | Source | |
| 24.04 LTS(noble) - ppa:ondrej/php | php8.2 | 8.2.35-1+ubuntu24.04.1+deb.sury.org+1 | Fixed | Source | |
| 24.04 LTS(noble) - ppa:ondrej/php | php8.1 | 8.1.34-9+ubuntu24.04.1+deb.sury.org+1 | Fixed | Source | |
| 24.04 LTS(noble) - ppa:ondrej/php | php8.0 | 1:8.0.30-25+ubuntu24.04.1+deb.sury.org+1 | Fixed | Source | |
| 24.04 LTS(noble) - ppa:ondrej/php | php7.4 | 1:7.4.33-31+ubuntu24.04.1+deb.sury.org+1 | Fixed | Source | |
| 24.04 LTS(noble) - ppa:ondrej/php | php7.3 | 7.3.33-35+ubuntu24.04.1+deb.sury.org+1 | Fixed | Source | |
| 24.04 LTS(noble) - ppa:ondrej/php | php7.2 | 7.2.34-66+ubuntu24.04.1+deb.sury.org+1 | Fixed | Source | |
| 24.04 LTS(noble) - ppa:ondrej/php | php5.6 | 5.6.40-104+ubuntu24.04.1+deb.sury.org+1 | Fixed | Source | |
| 24.04 LTS(noble) - ppa:ondrej/php | php7.0 | 7.0.33-92+ubuntu24.04.1+deb.sury.org+1 | Fixed | Source | |
| 24.04 LTS(noble) - ppa:ondrej/php | php7.1 | 7.1.33-80+ubuntu24.04.1+deb.sury.org+1 | Fixed | Source | |
| 22.04 LTS(jammy) - ppa:ondrej/php | php8.5 | 8.5.12-1+ubuntu22.04.1+deb.sury.org+1 | Fixed | Source | |
| 22.04 LTS(jammy) - ppa:ondrej/php | php8.4 | 8.4.27-1+ubuntu22.04.1+deb.sury.org+1 | Fixed | Source | |
| 22.04 LTS(jammy) - ppa:ondrej/php | php8.3 | 8.3.36-1+ubuntu22.04.1+deb.sury.org+1 | Fixed | Source | |
| 22.04 LTS(jammy) - ppa:ondrej/php | php8.2 | 8.2.35-1+ubuntu22.04.1+deb.sury.org+1 | Fixed | Source | |
| 22.04 LTS(jammy) - ppa:ondrej/php | php8.1 | 8.1.34-9+ubuntu22.04.1+deb.sury.org+1 | Fixed | Source | |
| 22.04 LTS(jammy) - ppa:ondrej/php | php8.0 | 1:8.0.30-25+ubuntu22.04.1+deb.sury.org+1 | Fixed | Source | |
| 22.04 LTS(jammy) - ppa:ondrej/php | php7.4 | 1:7.4.33-31+ubuntu22.04.1+deb.sury.org+1 | Fixed | Source | |
| 22.04 LTS(jammy) - ppa:ondrej/php | php7.3 | 7.3.33-35+ubuntu22.04.1+deb.sury.org+1 | Fixed | Source | |
| 22.04 LTS(jammy) - ppa:ondrej/php | php7.2 | 7.2.34-66+ubuntu22.04.1+deb.sury.org+1 | Fixed | Source | |
| 22.04 LTS(jammy) - ppa:ondrej/php | php5.6 | 5.6.40-104+ubuntu22.04.1+deb.sury.org+1 | Fixed | Source | |
| 22.04 LTS(jammy) - ppa:ondrej/php | php7.0 | 7.0.33-92+ubuntu22.04.1+deb.sury.org+1 | Fixed | Source | |
| 22.04 LTS(jammy) - ppa:ondrej/php | php7.1 | 7.1.33-80+ubuntu22.04.1+deb.sury.org+1 | Fixed | Source |
deb.sury.org
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| Debian bullseye / bookworm / trixie(packages.sury.org/php) | php8.5 | 8.5.12-1 | Fixed | Source | |
| Debian bullseye / bookworm / trixie(packages.sury.org/php) | php8.4 | 8.4.27-1 | Fixed | Source | |
| Debian bullseye / bookworm / trixie(packages.sury.org/php) | php8.3 | 8.3.36-1 | Fixed | Source | |
| Debian bullseye / bookworm / trixie(packages.sury.org/php) | php8.2 | 8.2.35-1 | Fixed | Source | |
| Debian bullseye / bookworm / trixie(packages.sury.org/php) | php8.1 | 8.1.34-9 | Fixed | Source | |
| Debian bullseye / bookworm / trixie(packages.sury.org/php) | php8.0 | 1:8.0.30-25 | Fixed | Source | |
| Debian bullseye / bookworm / trixie(packages.sury.org/php) | php7.4 | 1:7.4.33-31 | Fixed | Source |
Remi repository
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| Enterprise Linux 10(remi-modular / remi-safe) | php:remi-8.5 / php85-php | 8.5.12-1.el10.remi | Fixed | Source | |
| Enterprise Linux 10(remi-modular / remi-safe) | php:remi-8.4 / php84-php | 8.4.27-1.el10.remi | Fixed | Source | |
| Enterprise Linux 10(remi-modular / remi-safe) | php:remi-8.3 / php83-php | 8.3.36-1.el10.remi | Fixed | Source | |
| Enterprise Linux 10(remi-modular / remi-safe) | php:remi-8.2 / php82-php | 8.2.35-1.el10.remi | Fixed | Source | |
| Enterprise Linux 9(remi-modular / remi-safe) | php:remi-8.5 / php85-php | 8.5.12-1.el9.remi | Fixed | Source | |
| Enterprise Linux 9(remi-modular / remi-safe) | php:remi-8.4 / php84-php | 8.4.27-1.el9.remi | Fixed | Source | |
| Enterprise Linux 9(remi-modular / remi-safe) | php:remi-8.3 / php83-php | 8.3.36-1.el9.remi | Fixed | Source | |
| Enterprise Linux 9(remi-modular / remi-safe) | php:remi-8.2 / php82-php | 8.2.35-1.el9.remi | Fixed | Source | |
| Enterprise Linux 8(remi-modular / remi-safe) | php:remi-8.5 / php85-php | 8.5.12-1.el8.remi | Fixed | Source | |
| Enterprise Linux 8(remi-modular / remi-safe) | php:remi-8.4 / php84-php | 8.4.27-1.el8.remi | Fixed | Source | |
| Enterprise Linux 8(remi-modular / remi-safe) | php:remi-8.3 / php83-php | 8.3.36-1.el8.remi | Fixed | Source | |
| Enterprise Linux 8(remi-modular / remi-safe) | php:remi-8.2 / php82-php | 8.2.35-1.el8.remi | Fixed | Source |