These answers match the PHP advisory and the vendor notices reviewed on 22 October 2026. They are not a scan of your server.
Patching
Install a fixed upstream release or a vendor package that names both CVEs. Restart the SAPI that serves traffic. Check that process again. CLI output alone is not the check.
Temporary settings are documented in the mitigations guide. PHP says they are incomplete.
Legacy PHP
This site’s consulting scope includes PHP 5.6 and every newer branch. The PHP project did not publish a 5.6 fix. A plan for 5.6 can include a vendor package when one exists, isolation, or a migration. It should not include a made-up patch level.
PHP 7.4, 8.0, and 8.1 have minimal source backports and no new upstream tags. Building them is optional for teams that already compile PHP. A distribution update is preferable when the distribution shipped one.
Evidence this site will not invent
We do not publish exploit requests, customer counts, or a guarantee that every legacy application can be patched in place. If a distribution was not in the sources opened on 22 October 2026, the relevant guide says the package status was not confirmed.
Questions
Which CVEs are PHP2Shell?
CVE-2026-109618 and CVE-2026-109619.
What is the severity?
PHP scores both CVSS v4.0 9.2. Red Hat published a separate CVSS v3 score of 8.1 for its products.
What are the upstream fixes?
8.2.35, 8.3.36, 8.4.27, and 8.5.12.
Does PHP-FPM need the update?
Yes. PHP lists it as in scope and validated one remote code execution path against it.
Does PHP 5.6 have an upstream fix?
No tagged release and no source backport were announced for 5.6. Some vendors patched older packages. Check that vendor.
Will you scan my site?
No. The tools on this site run in the browser and classify the version you type.