Search documentation
AlmaLinuxAlmaLinux shipped patched PHP streams on 21 October 2026AlpineAlpine PHP fixes were not confirmed in this reviewCloudAmazon EC2CloudAmazon ECSConsultingApache and PHP consultingApacheApache mod_php is the highest-risk PHP2Shell setupApacheWhat proxy_fcgi changes for PHP2ShellApachePHP2Shell when Apache proxies to PHP-FPMCloudAWS Elastic BeanstalkCloudAzure PHP hostingCaddyCaddy and PHP-FPM: patch the upstream FastCGI appCentOSCentOS Linux will not get a normal PHP2Shell errataInventorySee whether Apache has mod_php loadedInventoryCheck the installed PHP version without fooling yourselfInventoryCheck the PHP-FPM version that is actually runningCloudCI/CD patch workflowcPanelcPanel: update the PHP runtime, not only the applicationCVECVE-2026-109618: remote code execution via out-of-memory corruptionCVECVE-2026-109619: remote code execution via stale global stateDebianDebian 10 was not listed as fixedDebianDebian 11 was not in the fixed tracker rowsDebianDebian 12 bookworm: install php8.2 8.2.35-1~deb12u1DebianDebian 13 trixie: php8.4 8.4.27-1~deb13u1CloudDocker ComposeCloudDocker imagesDrupalDrupal: update the PHP runtime, not only the applicationConsultingEmergency PHP securityIncidentFirst day response for PHP2ShellFedoraFedora PHP package status was not confirmed hereFrankenPHPFrankenPHP is called out in the PHP advisoryCloudGoogle Cloud PHP hostingOperationsHow to check whether your PHP runtime is in the fixed rangeRemediationHow to fix PHP2Shell on a server you operateInventoryFind the PHP runtime that is reachable from the internetCloudImmutable serversJoomlaJoomla: update the PHP runtime, not only the applicationCloudKubernetesLaravelLaravel: update the PHP runtime, not only the applicationConsultingLegacy PHP securityLiteSpeedLiteSpeed LSAPI and PHP2ShellMagento and Adobe CommerceMagento and Adobe Commerce: update the PHP runtime, not only the applicationManaged VPS hostingManaged VPS hosting: update the PHP runtime, not only the applicationMoodleMoodle: update the PHP runtime, not only the applicationInventoryPatch every PHP version a vhost still callsNextcloudNextcloud: update the PHP runtime, not only the applicationConsultingNginx and PHP consultingNginxRemediate PHP2Shell for Nginx with PHP-FPMLiteSpeedOpenLiteSpeed PHP handlers need their own build checkedVersionsPatched PHP versions for PHP2ShellPHP versionPHP 5.3 and PHP2ShellPHP versionPHP 5.4 and PHP2ShellPHP versionPHP 5.5 and PHP2ShellPHP versionPHP 5.6 and PHP2ShellPHP versionPHP 7.0 and PHP2ShellPHP versionPHP 7.1 and PHP2ShellPHP versionPHP 7.2 and PHP2ShellPHP versionPHP 7.3 and PHP2ShellPHP versionPHP 7.4 and PHP2ShellPHP versionPHP 8.0 and PHP2ShellPHP versionPHP 8.1 and PHP2ShellPHP versionPHP 8.2 and PHP2ShellPHP versionPHP 8.3 and PHP2ShellPHP versionPHP 8.4 and PHP2ShellPHP versionPHP 8.5 and PHP2ShellCompatibilityExtensions that break when PHP changesConsultingPHP incident responseLegacy PHPPHP 5.5 and older, including 5.3 and 5.4ChangePlan the rollback before you upgrade PHPChangeReduce downtime without skipping the worker restartConsultingPHP version upgradesConsultingPHP vulnerability assessmentSAPIphp-cgi is in scope for PHP2ShellConsultingPHP-FPM reviewVersionsWhich PHP versions PHP2Shell affectsApacheApache serves PHP in more than one wayNginxNginx is not the vulnerable componentFAQPHP2Shell frequently asked questionsIncidentIf you suspect a PHP worker was compromisedDetectionWhat to look for in logs while you patchMitigationTemporary PHP2Shell mitigations, and why they are not the fixDebianDebian PHP2Shell packages that were listed as fixedUbuntuUbuntu published PHP2Shell fixes for supported releasesConsultingPHP2Shell remediationRiskWhat the remote code execution risk actually meansRiskA practical risk assessment for PHP2ShellAnalysisTechnical analysis of the two PHP2Shell defectsVulnerabilityPHP2Shell: the two critical PHP runtime vulnerabilitiesPleskPlesk: update the PHP runtime, not only the applicationPrestaShopPrestaShop: update the PHP runtime, not only the applicationConsultingProduction PHP patchingCloudRebuilding PHP imagesOperationsRestart PHP-FPM after a security updateCloudReverse proxiesRHELRed Hat's PHP2Shell rating is not the upstream version checkRocky LinuxRocky Linux package status was not confirmed in this reviewLegacyWhat you can honestly do with end-of-life PHPShared hostingShared hosting: update the PHP runtime, not only the applicationSymfonySymfony: update the PHP runtime, not only the applicationTYPO3TYPO3: update the PHP runtime, not only the applicationUbuntuUbuntu 20.04 fixes php7.4 via ESMUbuntuUbuntu 22.04: php8.1 8.1.2-1ubuntu2.28UbuntuUbuntu 24.04 keeps version 8.3.6 and still has a fixUbuntuUbuntu 26.04 php8.5 is fixed in 8.5.4-0ubuntu1.5VerificationVerify a vendor backport without trusting the upstream versionVerificationVerify the patch after the upgradeVulnerabilityWhat PHP2Shell refers toWindowsWindows PHP builds follow the upstream security releasesWooCommerceWooCommerce: update the PHP runtime, not only the applicationWordPressWordPress: update the PHP runtime, not only the application