php.net’s fix covers only PHP 8.2 and newer. If your servers run 8.1, 8.0, 7.4 or 5.x, no fix is coming from php.net. Tell us the version you run. We patch both CVEs in that same version and send you the build, free.
On October 20, details of two PHP bugs leaked before the embargo ended. The PHP security team confirmed both and fixed them in a security release on October 21, 2026. Researchers call the pair PHP2Shell. See the php.net release notes for the full details, affected versions and fixed versions.
CVE-2026-109618 and CVE-2026-109619 are both rated CVSS v4.0 9.2. Researchers report remote code execution in PHP itself, before your application code runs. You can’t fix it in your app.
Sansec expects mass attacks within 15 minutes of the release. Once the fix is public, it shows attackers where the bug is.
php.net releases cover PHP 8.2, 8.3, 8.4 and 8.5. Reports say the bugs go back to PHP 5.4. Every branch from 5.4 to 8.1 is end of life, so php.net ships nothing for it.
Assume any PHP from 5.4 up is affected unless the php.net release notes say otherwise. The question that matters is which branch you run, because that decides whether php.net ships a fix for you.
The command line and the web server can use different PHP builds on the same host. Check the one that serves traffic.
php -v
php-fpm8.1 -v # Debian and Ubuntu name php-fpm per version
curl -sI https://your-site.example | grep -i x-powered-byCompare the package names with the table below.
# Debian, Ubuntu (deb)
dpkg -l 'php*' | grep ^ii
# RHEL, CentOS, Rocky, Alma, Amazon Linux (rpm)
rpm -qa 'php*'
# Alpine (apk)
apk list --installed 'php*'Images built FROM php:7.4-apache, php:8.0-fpm, php:8.1-cli or older carry PHP that php.net no longer fixes.
docker run --rm --entrypoint php your-image:tag -v8.2 or newer: install the fixed release from php.net or your OS vendor as soon as it ships. 8.1 or older: php.net ships no fix. Your OS vendor may backport one into its own package. If it doesn’t, we patch it for free.
If you set up a LAMP stack with apt install php, dnf install php
or apk add, this is the PHP you got. Package data checked October 21, 2026.
| Distro | Packages | PHP | php.net fix | Distro status |
|---|---|---|---|---|
| Ubuntu 20.04 LTS | php7.4, php7.4-fpm, libapache2-mod-php7.4 | 7.4 | No | Standard support ended May 2025. Updates only through Ubuntu Pro. |
| Ubuntu 22.04 LTS | php8.1, php8.1-fpm, libapache2-mod-php8.1 | 8.1 | No | Supported by Canonical. Watch the Ubuntu CVE tracker for a backport. |
| Ubuntu 24.04 LTS | php8.3, php8.3-fpm | 8.3 | Yes | Install the Ubuntu update. |
| Debian 10 (buster) | php7.3, php7.3-fpm | 7.3 | No | Out of LTS. Paid Extended LTS only. |
| Debian 11 (bullseye) | php7.4, php7.4-fpm | 7.4 | No | LTS ended August 31, 2026. Paid Extended LTS only. |
| Debian 12 (bookworm) | php8.2, php8.2-fpm | 8.2 | Yes | Install the Debian update. |
| Debian 13 (trixie) | php8.4, php8.4-fpm | 8.4 | Yes | Install the Debian update. |
| RHEL 7, CentOS 7 | php, php-fpm (rpm) | 5.4 | No | CentOS 7 ended June 30, 2024. RHEL 7 only with paid ELS. More on CentOS 7 end of life. |
| RHEL 8, Rocky 8, Alma 8 | php module streams: 7.2 (default), 7.4, 8.0, 8.2 | 7.2 to 8.0 | No (8.2 stream: yes) | Supported. Red Hat decides per stream, so check its CVE page. |
| RHEL 9, Rocky 9, Alma 9 | php 8.0 (default), module streams 8.1 and newer | 8.0, 8.1 | No (8.2+ streams: yes) | Supported. Red Hat decides per stream, so check its CVE page. |
| Amazon Linux 2 | php 7.x and 8.x from amazon-linux-extras | 7.x, 8.0, 8.1 | No | Support ended June 30, 2026. |
| Amazon Linux 2023 | php8.1, php8.2 and newer | 8.1 | No for php8.1 | Supported. Check the Amazon Linux security center. |
| Alpine 3.15 | php7, php8 (apk) | 7.4, 8.0 | No | Release out of support. |
| Alpine 3.16, 3.17 | php81 (3.16 also php8) | 8.1 | No | Release out of support. |
| Alpine 3.18, 3.19 | php81, php82 (3.19 also php83) | 8.1, 8.2+ | No for php81 | Move to php82 or newer, or patch php81. |
| Alpine 3.20 and newer | php82, php83, php84 | 8.2+ | Yes | Install the Alpine update. |
PHP gives each branch two years of bug fixes and two more years of security fixes. After that, nothing, not even for a 9.2. Here is where each branch stands on October 21, 2026.
For 8.1 and older, php.net’s answer is “upgrade to 8.2.” That’s a migration project, and these bugs won’t wait for it. We’ll patch the version you run instead, for free.
On 8.2 or newer, install the fixed release. On anything older, these are the real choices.
Two critical vulnerabilities in PHP, both rated CVSS v4.0 9.2, fixed in the PHP security release of October 21, 2026. Researchers call them PHP2Shell and report them as remote code execution in PHP core. The php.net release notes have the full details.
If you run PHP 5.4 through 8.1, assume yes, and php.net ships no fix for you. The common packages are php7.4 and php8.1 on Ubuntu 20.04 and 22.04 (deb), php7.3 and php7.4 on Debian 10 and 11 (deb), php 5.4 on RHEL and CentOS 7, the 7.2 to 8.1 php streams on RHEL 8 and 9 (rpm), and php7, php8 and php81 on Alpine (apk). On 8.2 or newer, assume you are affected until you install the fixed release. See the full package list and the commands to check.
The php.net release notes list the affected and fixed versions. Early reports said every release from PHP 5.4 on.
Not from php.net. It ships security releases only for supported branches, currently 8.2 through 8.5. PHP 8.1 reached end of life on December 31, 2025, 8.0 on November 26, 2023, 7.4 on November 28, 2022 and 5.6 on December 31, 2018.
Maybe. Ubuntu 22.04 and RHEL 8 and 9 are still supported, so their vendors may backport the fix into their own packages. Ubuntu 20.04, Debian 10 and 11, CentOS 7 and Amazon Linux 2 are out of standard support. If your vendor doesn’t ship a fix, Seal will.
Yes. For CVE-2026-109618 and CVE-2026-109619, we patch the PHP version you run at no charge. Book a short call, tell us your version, and we take it from there.
Install the fixed php.net release. Seal is for the PHP that can’t move that fast: the legacy app on 7.4, the vendor appliance on 8.0, the servers where an upgrade is a quarter of work.
Tell us the version you run. We’ll send back the same version with CVE-2026-109618 and CVE-2026-109619 fixed. Free.