Operating system guides
Match the package your distribution actually ships. An upstream version number is not enough when the vendor backports the fix.
AlmaLinuxAlmaLinux shipped patched PHP streams on 21 October 2026Package versions AlmaLinux listed for AlmaLinux 8, 9, and 10, including retired streams, and why php -v will not move.AlpineAlpine PHP fixes were not confirmed in this reviewCheck the Alpine secdb for both CVEs before you treat an edge release as patched. Do not assume the upstream version string moved.CentOSCentOS Linux will not get a normal PHP2Shell errataCentOS Linux 7 and 8 are end of life. Do not assume a CentOS PHP package was patched because AlmaLinux or RHEL published one.DebianDebian 10 was not listed as fixedDebian 10 is end of life and was absent from the PHP2Shell tracker rows reviewed on 22 October 2026.DebianDebian 11 was not in the fixed tracker rowsThe Debian security tracker did not list a bullseye PHP2Shell fix on 22 October 2026.DebianDebian 12 bookworm: install php8.2 8.2.35-1~deb12u1The bookworm security update named by the Debian tracker, and why the base suite build was still marked vulnerable.DebianDebian 13 trixie: php8.4 8.4.27-1~deb13u1The trixie security package the Debian tracker listed for both PHP2Shell CVEs.DebianDebian PHP2Shell packages that were listed as fixedWhat the Debian security tracker showed for CVE-2026-109618 and CVE-2026-109619 on 22 October 2026.FedoraFedora PHP package status was not confirmed hereCheck Fedora's update system for both CVEs. This review does not name a Fedora NEVRA.RHELRed Hat's PHP2Shell rating is not the upstream version checkWhat Red Hat published about CVE-2026-109618, and the limit of what was confirmed for RHEL package versions.Rocky LinuxRocky Linux package status was not confirmed in this reviewDo not copy AlmaLinux version strings onto Rocky. Check Rocky's own errata.UbuntuUbuntu 20.04 fixes php7.4 via ESMThe Focal php7.4 package Ubuntu listed, and the Pro entitlement it depends on.UbuntuUbuntu 22.04: php8.1 8.1.2-1ubuntu2.28Jammy's fixed php8.1 revision stays on upstream version 8.1.2. Compare the package, then restart FPM.UbuntuUbuntu 24.04 keeps version 8.3.6 and still has a fixNoble's fixed package is 8.3.6-0ubuntu0.24.04.13. The upstream number does not become 8.3.36.UbuntuUbuntu 26.04 php8.5 is fixed in 8.5.4-0ubuntu1.5Resolute's php8.5 backport is below upstream 8.5.12 and is the package Ubuntu listed.UbuntuUbuntu published PHP2Shell fixes for supported releasesPackage revisions from Ubuntu's 21 October 2026 notice, including ESM releases and the restart Ubuntu says you still need.WindowsWindows PHP builds follow the upstream security releasesPHP's release notes say Windows binaries for 8.2.35, 8.3.36, 8.4.27, and 8.5.12 are on the downloads page.