Check PHP2Shell patch status

Check for fixes covering both CVE-2026-109618 and CVE-2026-109619. Do not run exploit probes.

Identify the serving installation

Identify the PHP installation serving the site, including its container if applicable. The default CLI PHP may differ from PHP-FPM or Apache's PHP module.

Inspect the serving binary or Apache module and its owning package directly. Determine the OS release and package provider before choosing an advisory.

Check patch status

Compare the full package revision against vendor guidance covering both CVEs. An older upstream version alone does not prove vulnerability. Configuration settings alone do not establish patch status.

The fixed package versions below were verified on 2026-10-22. They apply only to official packages for the listed OS release and PHP branch. Use the listed version or a later version from the same vendor release and stream.

Debian

Use dpkg-query to read the full installed package version and dpkg --compare-versions for comparisons. Match the Debian release to its records for CVE-2026-109618 and CVE-2026-109619.

These are source package versions. Check the serving binary's package, such as php8.2-fpm or libapache2-mod-php8.2, against the corresponding source.

Ubuntu

Use dpkg-query to read the full installed package version and dpkg --compare-versions for comparisons. Match the Ubuntu release and PHP package to the advisory below.

Check the package serving the site, such as php8.3-fpm or libapache2-mod-php8.3, rather than relying on the php metapackage.

RHEL

Use rpm -qf on the serving binary or Apache module to identify its owning package. Read its full version and vendor with:

rpm -q --queryformat '%{NAME} %{EPOCHNUM}:%{VERSION}-%{RELEASE}.%{ARCH} %{VENDOR}\n' PACKAGE

Match the RHEL major/minor release and PHP module stream to the Red Hat advisory. Use dnf module list php --enabled where module streams apply. Known backports covering both CVEs include:

Use RPM version ordering, including the epoch, within the matching release and stream. For other RHEL streams, consult Red Hat's records for CVE-2026-109618 and CVE-2026-109619.

Upstream and other builds

For other providers, use their own advisories. Do not apply Debian, Ubuntu or RHEL thresholds to another vendor's packages or custom builds.

The upstream fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Older branches may have vendor or source backports.

Verify the running site and report

A fixed installed package does not prove that web workers use it. Confirm the serving installation and whether workers restarted after the update. If that cannot be established, report the running site's patch status as unknown.

Report the package and version checked, the advisory and any required update. Describe packages below the vendor fix as potentially vulnerable. If package or build evidence is unavailable, or the provider or applicable advisory cannot be established, report unknown.