Update the runtime serving your website
The PHP vulnerability fix is available upstream in 8.5.12, 8.4.27, 8.3.36, 8.2.35. Distribution package numbers may differ. Use the platform guide and compare the complete revision.
Check your pasted version →Two advisories, one update task
CVE-2026-109618: RCE via OOM corruption
The PHP project rates this issue Critical. Apply a runtime update that covers both published advisories. This guide focuses on choosing and verifying that update.
CVE-2026-109619: RCE via stale global state
The PHP project rates this issue Critical. Apply a runtime update that covers both published advisories. This guide focuses on choosing and verifying that update.
Who needs to update?
The PHP announcement covers installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP identifies mod_php as the highest-risk configuration. Do not infer safety from the application framework or hosting panel alone.
Fixed releases & supported branches
| PHP branch | PHP2Shell fix | Active support until | Security support until | Upstream status |
|---|---|---|---|---|
| PHP 8.5 | 8.5.12 ↗ | 2027-12-31 | 2029-12-31 | Active support |
| PHP 8.4 | 8.4.27 ↗ | 2026-12-31 | 2028-12-31 | Active support |
| PHP 8.3 | 8.3.36 ↗ | 2025-12-31 | 2027-12-31 | Security fixes only |
| PHP 8.2 | 8.2.35 ↗ | 2024-12-31 | 2026-12-31 | Security fixes only |
| PHP 8.1 | No upstream release | Ended | 2025-12-31 | End of life |
| PHP 8.0 | No upstream release | Ended | 2023-11-26 | End of life |
| PHP 7.4 | No upstream release | Ended | 2022-11-28 | End of life |
Branch status checked at 2026-10-21 15:26:08 UTC. PHP support policy ↗
PHP 8.6 is a prerelease branch: do not select it for production. For branches older than those listed above, consult the PHP end-of-life table and your vendor's support policy.
Older branches need a vendor decision
The PHP project no longer publishes releases for its end-of-life branches. It has provided minimal source backports for vendors. Confirm a vendor package for this PHP vulnerability and schedule migration to a supported branch.
If you cannot update immediately
Temporary mitigation is not a complete fix. A PHP vulnerability affecting web requests needs a verified runtime update. Have your administrator assess the availability and operational impact of these measures.
- PHP lists removing the memory limit, reducing accepted POST size, and disabling session upload progress as temporary measures. Removing the memory limit can exhaust host resources.
- For the branch covered by the advisory, PHP also lists disabling fatal-error backtraces. Correct recurring startup configuration warnings and restart all workers.
- Read the exact settings and limitations in the PHP security advisory before making configuration changes.
Verify the PHP security update
Confirm the package source, complete revision and web runtime. Restart all serving workers. A pasted version is useful evidence for this PHP vulnerability, but this website does not inspect a running server.
Runtime verification guide →Release timeline
The PHP project published the security announcement on 2026-10-21. Package and image publication can follow at different times; each platform row carries its own checked-at timestamp.
About this guide and the PHP2Shell name
PHP2Shell is the shorthand used here for the two linked CVE advisories. This independent PHP vulnerability guide links to PHP and vendor documentation, records check times, and keeps uncertain package states explicit.