PHP2Shell on Ubuntu, Debian and RHEL: Fixed Package Versions
Linux distributions ship PHP2Shell fixes as backported packages, so the version number often stays the same as before. This page lists the fixed package versions for Ubuntu and Debian, Red Hat's status, and how to check what you have installed.
Why the PHP version looks old after the PHP2Shell fix
Upstream PHP fixed PHP2Shell (CVE-2026-109618 and CVE-2026-109619) in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Distributions such as Ubuntu and Red Hat usually copy only the fix into the PHP version they already ship. That means Ubuntu 24.04 still reports PHP 8.3.6 after the update. The full package version, not the PHP version, tells you whether you are patched. That is also why the PHP2Shell checker cannot always judge a distribution build from its headers alone.
Ubuntu PHP2Shell fix (USN-8948-1, USN-8948-2)
Ubuntu published its notices on October 21, 2026 with priority Critical.
| Ubuntu release | Package | Fixed version |
|---|---|---|
| 26.10 | php8.5 | 8.5.9-0ubuntu2.1 |
| 26.04 LTS | php8.5 | 8.5.4-0ubuntu1.5 |
| 24.04 LTS | php8.3 | 8.3.6-0ubuntu0.24.04.13 |
| 22.04 LTS | php8.1 | 8.1.2-1ubuntu2.28 |
| 20.04 (Ubuntu Pro) | php7.4 | 7.4.3-4ubuntu2.29+esm5 |
| 18.04 (Ubuntu Pro) | php7.2 | 7.2.24-0ubuntu0.18.04.17+esm14 |
| 16.04 (Pro Legacy) | php7.0 | 7.0.33-0ubuntu0.16.04.16+esm22 |
| 14.04 (Pro Legacy) | php5 | 5.5.9+dfsg-1ubuntu4.29+esm18 |
dpkg -l 'php*' | grep ^ii
sudo apt update && sudo apt upgrade
sudo systemctl restart php*-fpm apache2Releases 20.04 and older only get the fix through Ubuntu Pro (ESM). If you use the ondrej/php PPA instead of Ubuntu's own packages, you need the upstream fixed version from that PPA.
Debian PHP2Shell fix
| Debian release | Advisory | Fixed version |
|---|---|---|
| 13 trixie | DSA-6574-1 | php8.4 8.4.27-1~deb13u1 |
| 12 bookworm | DLA-4848-1 | php8.2 8.2.35-1~deb12u1 |
| forky / sid | - | Still listed as vulnerable when checked |
apt-cache policy php8.4-fpm
zgrep CVE-2026-109618 /usr/share/doc/php8.4-common/changelog.Debian.gzUsers of the sury.org repository get upstream PHP releases, so look for 8.2.35, 8.3.36, 8.4.27 or 8.5.12 there.
PHP2Shell on Red Hat Enterprise Linux
Red Hat rates both CVEs Important, with CVSS v3.1 8.1, and notes that RHEL uses PHP-FPM rather than mod_php, which makes remote code execution harder in practice. No RHSA was listed when we checked, so follow Red Hat's CVE page. When packages ship, look for the CVE in the changelog:
rpm -q --changelog php-common | grep CVE-2026-10961We found no published notices yet for AlmaLinux, Rocky Linux or Alpine. They usually follow their upstream (RHEL or Alpine's own PHP packages) within days. The Remi repository had no update on release day.
PHP2Shell on older PHP branches: 8.1, 8.0, 7.4
PHP published source-only backports for 7.4, 8.0 and 8.1, without official binaries. Ubuntu's ESM packages above include fixes for php7.4, php7.2, php7.0 and php5. If you run an old branch from another source, plan a move to a supported release; see the PHP2Shell patch guide.
PHP2Shell distro packages FAQ
Ubuntu shows PHP 8.3.6. Is that vulnerable?
Not if the package is 8.3.6-0ubuntu0.24.04.13 or later. Ubuntu backports the fix and keeps the upstream number, so compare the full package version, not just 8.3.6.
Is there a Red Hat RHSA for PHP2Shell?
Red Hat rates the CVEs Important (CVSS 8.1) and notes RHEL runs PHP through PHP-FPM rather than mod_php. No RHSA was listed when we checked; follow its CVE page for updates.
Do I need to restart after the package update?
Yes. Restart PHP-FPM and Apache so the patched binaries are loaded. Running workers keep the old code until they restart.
My distro is not listed. What should I do?
Search your vendor's security tracker for CVE-2026-109618. If no fixed package exists, build from the official PHP sources or move to a supported release.