Back up your application and configuration, and test in staging before applying a PHP vulnerability update. Use only the package source and branch actually installed on your system.
Vendor package status
| Branch / source | Confirmed package | PHP2Shell status |
|---|---|---|
| PHP 8.5 docker-library | See vendor advisory Source ↗ | Fix not yet confirmed in packages Checked at 2026-10-21 15:26:15 UTC |
| PHP 8.4 docker-library | See vendor advisory Source ↗ | Fix not yet confirmed in packages Checked at 2026-10-21 15:26:15 UTC |
| PHP 8.3 docker-library | See vendor advisory Source ↗ | Fix not yet confirmed in packages Checked at 2026-10-21 15:26:15 UTC |
| PHP 8.2 docker-library | See vendor advisory Source ↗ | Fix not yet confirmed in packages Checked at 2026-10-21 15:26:15 UTC |
| PHP 8.1 docker-library | See vendor advisory Source ↗ | End-of-life upstream Checked at 2026-10-21 15:26:15 UTC |
| PHP 8.0 docker-library | See vendor advisory Source ↗ | End-of-life upstream Checked at 2026-10-21 15:26:15 UTC |
| PHP 7.4 docker-library | See vendor advisory Source ↗ | End-of-life upstream Checked at 2026-10-21 15:26:15 UTC |
A confirmed advisory records vendor publication. It does not inspect your machine. Status not confirmed means no verified package threshold is recorded for that combination.
Which source installed your PHP?
An image tag, a registry manifest and the PHP runtime inside the image are separate pieces of evidence. Pin and verify the exact stable image.
This PHP vulnerability guide does not infer package publication from a source upload, a planned update or a release-candidate tag.
PHP 8.5: update, restart and verify
docker-library
Image publication must be confirmed by pulling the exact stable tag and checking the runtime. Release-candidate tags are not evidence of a fix.
Checked at 2026-10-21 15:26:15 UTC · Vendor source ↗
Update → Restart → Verify
Untested — follow vendor docs. Executable commands are withheld because this exact environment has not been tested. Back up and test in staging, apply the vendor update, restart the PHP runtime, and compare the installed package with the advisory.
Open vendor instructions ↗PHP 8.4: update, restart and verify
docker-library
The official 8.4-cli tag was pulled and ran PHP 8.4.26 in our ARM64 test. The stable fixed tag was not available. Do not treat the floating tag as patched.
Checked at 2026-10-21 15:26:15 UTC · Vendor source ↗
Verify
docker run --rm registry-1.docker.io/library/php:8.4-cli php -vTested in Docker official php:8.4-cli image (ARM64), 2026-10-21 UTC. Run only for this source and installed branch. Commands require administrator access.
PHP 8.3: update, restart and verify
docker-library
Image publication must be confirmed by pulling the exact stable tag and checking the runtime. Release-candidate tags are not evidence of a fix.
Checked at 2026-10-21 15:26:15 UTC · Vendor source ↗
Update → Restart → Verify
Untested — follow vendor docs. Executable commands are withheld because this exact environment has not been tested. Back up and test in staging, apply the vendor update, restart the PHP runtime, and compare the installed package with the advisory.
Open vendor instructions ↗PHP 8.2: update, restart and verify
docker-library
Image publication must be confirmed by pulling the exact stable tag and checking the runtime. Release-candidate tags are not evidence of a fix.
Checked at 2026-10-21 15:26:15 UTC · Vendor source ↗
Update → Restart → Verify
Untested — follow vendor docs. Executable commands are withheld because this exact environment has not been tested. Back up and test in staging, apply the vendor update, restart the PHP runtime, and compare the installed package with the advisory.
Open vendor instructions ↗PHP 8.1: update, restart and verify
docker-library
Image publication must be confirmed by pulling the exact stable tag and checking the runtime. Release-candidate tags are not evidence of a fix.
Checked at 2026-10-21 15:26:15 UTC · Vendor source ↗
Update → Restart → Verify
Untested — follow vendor docs. Executable commands are withheld because this exact environment has not been tested. Back up and test in staging, apply the vendor update, restart the PHP runtime, and compare the installed package with the advisory.
Open vendor instructions ↗PHP 8.0: update, restart and verify
docker-library
Image publication must be confirmed by pulling the exact stable tag and checking the runtime. Release-candidate tags are not evidence of a fix.
Checked at 2026-10-21 15:26:15 UTC · Vendor source ↗
Update → Restart → Verify
Untested — follow vendor docs. Executable commands are withheld because this exact environment has not been tested. Back up and test in staging, apply the vendor update, restart the PHP runtime, and compare the installed package with the advisory.
Open vendor instructions ↗PHP 7.4: update, restart and verify
docker-library
Image publication must be confirmed by pulling the exact stable tag and checking the runtime. Release-candidate tags are not evidence of a fix.
Checked at 2026-10-21 15:26:15 UTC · Vendor source ↗
Update → Restart → Verify
Untested — follow vendor docs. Executable commands are withheld because this exact environment has not been tested. Back up and test in staging, apply the vendor update, restart the PHP runtime, and compare the installed package with the advisory.
Open vendor instructions ↗If you cannot update immediately
Temporary mitigation is not a complete fix. A PHP vulnerability affecting web requests needs a verified runtime update. Have your administrator assess the availability and operational impact of these measures.
- PHP lists removing the memory limit, reducing accepted POST size, and disabling session upload progress as temporary measures. Removing the memory limit can exhaust host resources.
- For the branch covered by the advisory, PHP also lists disabling fatal-error backtraces. Correct recurring startup configuration warnings and restart all workers.
- Read the exact settings and limitations in the PHP security advisory before making configuration changes.
After the PHP security update
Test critical requests, application logs, scheduled tasks and background workers. Keep a record of the package source and revision used to resolve this PHP vulnerability. If the branch is end-of-life, plan the next supported-version migration.
Plan a supported-version migration →Common questions
Why does my PHP version still look old after updating?
Distribution vendors often backport a PHP vulnerability fix without changing the upstream version. Match the installed package revision to your vendor advisory and confirm the web runtime.
Does updating command-line PHP also update my website?
It depends on your installed runtimes. The command line, PHP-FPM and a hosting panel can use different binaries. Verify the runtime serving each website after the PHP security update.
Do I need to restart PHP workers?
Yes. Follow the vendor restart procedure for all serving workers, including PHP-FPM, Apache and long-running application workers. A package update alone does not prove every process is running the new runtime.