PHP 8.1 reached upstream end of life on 31 December 2025. The last upstream release on the end-of-life table is 8.1.34. That number is not the PHP2Shell fix. PHP’s fixed range starts at 8.2.35 for the next branch. For 8.1 itself, PHP published a source backport, branch PHP-8.1-CVE-2026-109618-109619, and no tag.
Lifecycle
PHP 8.1 reached end of life on 31 December 2025. The reference point from php.net is 8.1.34. End-of-life status and a vendor backport are different facts. A branch can be unsupported by the PHP project and still have a distribution build that includes these two fixes.
What is confirmed about exposure
The defects are in the PHP runtime, so a PHP 8.1 process that serves HTTP is in the population PHP told users to update. mod_php is the highest-risk integration. PHP-FPM is not excluded. An application update does not change this runtime.
Upstream options
There is no tagged upstream release that fixes PHP2Shell on PHP 8.1. The source backport PHP published is the only upstream artifact, and it is not a version number you can apt-get from php.net as a security tag.
Vendor packages
Ubuntu 22.04 lists php8.1 fixed in 8.1.2-1ubuntu2.28 under standard support, via USN-8948-1. The upstream version string stays 8.1.2. AlmaLinux 9 lists a retired php:8.1 stream at php-8.1.32-1.module_el9.8.0+326+528679fc.alma.1. Debian’s tracker pages reviewed on 22 October 2026 did not show a php8.1 suite fix. Debian 12’s PHP package in that tracker is php8.2.
Nginx, Apache, and PHP-FPM
Nginx and Apache only route the request. On PHP 8.1, identify whether the vhost uses PHP-FPM, mod_php, or CGI. mod_php remains the highest-risk SAPI in PHP’s advisory regardless of how old the branch is. PHP-FPM on 8.1 is still in scope for CVE-2026-109619’s session path. Restart the daemon that loaded this branch after any package change. A host with PHP 8.1 and a newer PHP side by side is only fixed for the vhost you actually updated.
Remediation paths
Ubuntu 22.04 systems should upgrade the php8.1 packages and restart FPM or Apache. Other 8.1 installs need their own errata or a move to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 after compatibility tests. CISA’s alert specifically called out PHP 8.1 and earlier that cannot be updated.
Temporary settings from the PHP advisory remain available and remain incomplete. See the mitigations page.
Production precautions
Snapshot or otherwise preserve the current packages before you change a production PHP 8.1 host. Expect a restart of php-fpm or Apache to drop active requests. If an extension fails to load, roll back and treat that as a compatibility problem, not as a reason to skip the CVE.
Validation
Query the binary the vhost uses after the restart. On backport-style packages, compare the package version rather than waiting for php -v to print a new upstream number. Check one authenticated and one anonymous application route you already know how to judge.
When to involve a specialist
Involve a specialist when PHP 8.1 is tied to a custom extension, a control-panel build, or a release process that cannot take the upstream tag directly. That is the normal case for this branch, not an edge case.
Questions
Is the last upstream PHP 8.1 release a PHP2Shell fix?
PHP 8.1 reached upstream end of life on 31 December 2025. The last upstream release on the end-of-life table is 8.1.34. That number is not the PHP2Shell fix. PHP's fixed range starts at 8.2.35 for the next branch. For 8.1 itself, PHP published a source backport, branch PHP-8.1-CVE-2026-109618-109619, and no tag.
Can you help if we cannot upgrade this week?
Yes. The engagement can cover a vendor package check, exposure reduction, or a migration plan. It will not pretend a missing patch exists.