The PHP project fixed PHP2Shell, CVE-2026-109618 and CVE-2026-109619, in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026. Its advisory then says the part most readers skip: Linux distributions and long-term-support vendors received the patches in advance, so check your vendor for updated packages. If you do not build PHP from source, the version your site runs comes from one of roughly a dozen kinds of vendor, and this page is a dated record of what each had shipped by the evening of release day, read from the vendor's own page, feed or package index. What the bug is and why it matters is in our PHP2Shell patch-now post; what this week should change in how you patch is in our security changes for 2026.
One finding runs through every table. Many vendors ship the fix without changing the PHP version number. Ubuntu 24.04's fixed package is still called 8.3.6, Red Hat's RHEL 9 default PHP is still 8.0.30, Sury's legacy builds still say 7.4.33 and 8.1.34, Chainguard's fixed package is 8.4.26 with a new revision suffix, and Plesk's fix for its end-of-life 7.4, 8.0 and 8.1 builds keeps the same version and changes only the build date. So a lower number can be fixed and an unchanged number can hide either state. Check the package or build string your vendor lists, not the output of php -v alone.
- 01Check the package string your vendor names, not php -v.Fifteen rows in this table are fixed builds whose PHP version number did not change: all eight Ubuntu rows, RHEL 9 and RHEL 8, AlmaLinux 8's php:7.4, Sury's legacy packages, cPanel's 7.4 to 8.1 backports, Plesk's end-of-life builds and Chainguard. The fix is in the package revision or the build date.
- 02The big distributions shipped on release day; the clones mostly did not.Debian stable and LTS, every current Ubuntu release and Ubuntu Pro, Red Hat's four main streams, SUSE SLE 15 SP7, Fedora 46 and 44 and Alpine 3.24 all had fixed packages by 20:44 UTC. AlmaLinux had one stream in production and the rest in testing; Rocky and Oracle had published nothing.
- 03PHP 8.1 and older have no upstream release, only backports.The PHP security team published source-only patch branches for 7.4, 8.0 and 8.1. Binaries for those versions come from Ubuntu Pro, Sury, Red Hat, cPanel, Plesk, CloudLinux or TuxCare, each on its own schedule and under the old version number.
- 04Control panels moved fast; the panel's own PHP lagged.cPanel and Plesk both shipped fixed builds for every supported and several end-of-life branches on October 21. Plesk's own sw-engine PHP was still a planned hotfix, DirectAdmin had posted nothing, and CloudLinux's alt-php was rolling out through the evening.
- 05Managed hosts split three ways: patched, patching, or silent.Pantheon, Laravel Cloud and Azure App Service named fixed versions. WP Engine and Kinsta said patching was in progress. SiteGround's post predated the release, Acquia was waiting on AWS, and AWS itself had no bulletin by 19:54 UTC.
01 — Version NumbersA lower number can be fixed, and an unchanged one can hide either state. #
Distributions and long-term-support vendors do not usually upgrade a package to the newest upstream release. They take the fix commit, apply it to the version they already ship, and bump the package revision. That is why Ubuntu 24.04's fixed PHP is 8.3.6-0ubuntu0.24.04.13 rather than 8.3.36, and why AlmaLinux 9's testing build is php-8.3.33 rather than 8.3.36. The upstream number says which release the source came from; the suffix says what the vendor has done to it since. Plesk's knowledge-base article states the extreme case in one sentence: its fixes for the end-of-life 7.4.33, 8.0.30 and 8.1.34 builds "have the same version number, but different build date", and builds dated October 21, 2026 include the fix.
The failure case is the obvious one. An administrator runs php -v, sees 8.3.6 on a patched Ubuntu server, compares it to the 8.3.36 in the advisory and upgrades by hand to a third-party build; or sees 7.4.33 on a Plesk server, assumes nothing has changed, and leaves a fixed server flagged as vulnerable while a genuinely unpatched one with the same number sits next to it. The six examples below are the rows where that confusion is most likely.
| Six fixed builds that keep an older PHP version number, from the vendor pages and package indexes listed in the tables below, read October 21, 2026. | |||
|---|---|---|---|
| Vendor | Looks like | Fixed package | Where the fix shows |
| --- | --- | --- | --- |
| Ubuntu 24.04 LTS | 8.3.6 | 8.3.6-0ubuntu0.24.04.13 | Package revision; USN-8948-1 |
| Red Hat RHEL 8, php:7.4 | 7.4.33 | php-7.4.33-8.module+el8.10.0+25117+30337cca | Package release; RHSA-2026:87080 |
| AlmaLinux 9, php:8.3 | 8.3.33 | php-8.3.33-1.module_el9.8.0+328+1fdeb728.alma.1 | Package release; testing at 20:31, production from 21:15 UTC |
| Sury, Debian 13, php8.1 | 8.1.34 | 8.1.34-9+0~20261021.82+debian13~1 | Date stamp in the revision; bailout patch in the source |
| Chainguard / Wolfi php-8.4 | 8.4.26 | 8.4.26-r4 | Revision suffix; listed against both CVEs in the security feed |
| Plesk, PHP 7.4 / 8.0 / 8.1 | 7.4.33 / 8.0.30 / 8.1.34 | Same version, built October 21, 2026 | Build date only, per Plesk's knowledge base |
02 — UpstreamThe PHP project: four releases, three source backports. #
The php.net advisory names four fixed releases and states that PHP 8.1 and older no longer receive updates from the project. What it adds, and what most coverage omits, is that the security team published minimal source backports for 7.4, 8.0 and 8.1 for people who build from source or have no long-term-support vendor. Those are git branches in the php-src repository with a single commit each, dated October 18; there is no tarball, no binary and no version bump. Windows builds for 8.2 to 8.5 were on windows.php.net by 13:49 UTC, just ahead of the scheduled release; the Windows 7.4, 8.0 and 8.1 builds were untouched.
| PHP project pages, the php-src repository and windows.php.net, read October 21, 2026 at the UTC time shown. Upstream version numbers are the fixed versions; a vendor build may carry a lower number and still include the fix. | |||
|---|---|---|---|
| PHP project source | Fixed build or package | Status | Read (UTC) |
| --- | --- | --- | --- |
| PHP project · PHP 8.5 | 8.5.12 | Fixed | 20:23 |
| PHP project · PHP 8.4 | 8.4.27 | Fixed | 20:23 |
| PHP project · PHP 8.3 | 8.3.36 | Fixed | 20:23 |
| PHP project · PHP 8.2 (security support ends Dec 31, 2026) | 8.2.35 | Fixed | 20:23 |
| PHP project · PHP 8.6.0 RC4 (pre-release, not for production) | 8.6.0RC4; its NEWS file names both CVEs | Fixed (pre-release) | 20:28 |
| PHP security team · PHP 7.4, 8.0, 8.1 | Source-only branches PHP-7.4-, PHP-8.0- and PHP-8.1-CVE-2026-109618-109619; no tarball, binary or version bump | Fixed (source patch for people who build PHP) | 20:27 |
| windows.php.net · 8.2 to 8.5 | php-8.5.12, 8.4.27, 8.3.36 and 8.2.35 Win32 zips (x64, x86, NTS) | Fixed | 20:28 |
| windows.php.net · 7.4, 8.0, 8.1 | Latest builds still 7.4.33, 8.0.30 and 8.1.34, unchanged since 2024–2025 | Not published | 20:28 |
03 — Debian FamilyDebian, Ubuntu and Sury: fixed on release day, under the old numbers. #
Debian's security team published DSA-6574-1 for trixie at 13:45 UTC, fifteen minutes before the scheduled release, and the LTS team followed for bookworm at 14:11 UTC. Canonical's USN-8948-1 covers every current Ubuntu release and USN-8948-2 covers the Ubuntu Pro releases back to 14.04, which means a 2014 PHP 5.5 package received this fix. Ubuntu ships no php8.2 or php8.4 of its own; those come from Ondřej Surý's repository and PPA, which published fixed 8.5 to 8.2 packages and backported the fix to every legacy branch down to 5.6, each carrying the upstream bailout patch. One wrinkle for anyone reading changelogs: the newest entry in Sury's php7.4 and php8.1 changelogs is a snapshot note, and the line naming both CVEs sits one entry below it.
| Debian security and LTS announcements, the Debian security tracker, Freexian's ELTS tracker, Ubuntu's USN-8948-1 and USN-8948-2, and the Sury repository and PPA package indexes, read October 21, 2026 at the UTC time shown. Sury strings are truncated after the date stamp. | |||
|---|---|---|---|
| Distribution · package | Fixed build or package | Status | Read (UTC) |
| --- | --- | --- | --- |
| Debian 13 trixie (stable) · php8.4 | 8.4.27-1~deb13u1 (DSA-6574-1) | Fixed | 20:25 |
| Debian 12 bookworm (LTS) · php8.2 | 8.2.35-1~deb12u1 (DLA-4848-1) | Fixed | 20:25 |
| Debian forky (testing) and sid · php8.4 | 8.4.26-1 listed as vulnerable, fixed version "(unfixed)" | Pending | 20:23 |
| Freexian Debian ELTS · 11 bullseye php7.4, 10 buster php7.3, 9 stretch php7.0 | Changed since: ELA-1853-1 php7.4 7.4.33-1+deb11u14, ELA-1854-1 php7.3 7.3.31-1~deb10u16 and ELA-1855-1 php7.0 7.0.33-0+deb9u26, dated October 21 (re-read 21:55 UTC) | Fixed (re-read) | 20:39 · 21:55 |
| Ubuntu 26.10 · php8.5 | 8.5.9-0ubuntu2.1 (USN-8948-1) | Fixed | 20:24 |
| Ubuntu 26.04 LTS · php8.5 | 8.5.4-0ubuntu1.5 (USN-8948-1) | Fixed | 20:24 |
| Ubuntu 24.04 LTS · php8.3 | 8.3.6-0ubuntu0.24.04.13 (USN-8948-1) | Fixed, version number unchanged | 20:24 |
| Ubuntu 22.04 LTS · php8.1 | 8.1.2-1ubuntu2.28 (USN-8948-1) | Fixed, version number unchanged | 20:24 |
| Ubuntu Pro 20.04 · php7.4 | 7.4.3-4ubuntu2.29+esm5 (USN-8948-2) | Fixed, Ubuntu Pro only | 20:24 |
| Ubuntu Pro 18.04 · php7.2 | 7.2.24-0ubuntu0.18.04.17+esm14 (USN-8948-2) | Fixed, Ubuntu Pro only | 20:24 |
| Ubuntu Pro Legacy 16.04 · php7.0 | 7.0.33-0ubuntu0.16.04.16+esm22 (USN-8948-2) | Fixed, Pro with Legacy Support only | 20:24 |
| Ubuntu Pro Legacy 14.04 · php5 | 5.5.9+dfsg-1ubuntu4.29+esm18 (USN-8948-2) | Fixed, Pro with Legacy Support only | 20:24 |
| Sury repository · Debian 13 and 12, php8.5 to php8.2 | 8.5.12-1+0~20261021…, 8.4.27-1+0~20261021…, 8.3.36-1+0~20261021…, 8.2.35-1+0~20261021… | Fixed | 20:26 |
| Sury repository · Debian 13 and 12, php8.1 down to php5.6 | 8.1.34-9+0~20261021…, 1:8.0.30-25+…, 1:7.4.33-31+…, 7.3.33-35+…, 7.2.34-66+…, 7.1.33-80+…, 7.0.33-92+…, 5.6.40-104+…; each carries the bailout patch | Fixed (backport, version number unchanged) | 20:27 |
| Sury Launchpad PPA ondrej/php · Ubuntu 24.04 and 22.04, 8.5 to 7.4 | 8.5.12-1+ubuntu24.04.1+… and matching 8.4.27, 8.3.36, 8.2.35, 8.1.34-9, 7.4.33-31 strings; jammy uses +ubuntu22.04.1; no 26.04 series | Fixed | 20:27 |
04 — RPM WorldRed Hat shipped, the clones were still in testing. #
Red Hat's errata landed through the afternoon, RHEL 8's php:7.4 module at 15:53 UTC and the RHEL 10 and 9 defaults around 20:10 UTC. Its own security bulletin notes that standard RHEL deployments use PHP-FPM rather than mod_php, which is the lower-risk configuration in php.net's reading. Two gaps remained at our read: the php:8.2, 8.3 and 8.4 module streams on RHEL 8 and 9 were listed in Red Hat's VEX data as affected with no remediation available, and RHEL 7 was listed as affected in the bulletin but not affected in the VEX. AlmaLinux, which rebuilds Red Hat's updates, had the php:7.4 rebuild in production and everything else in its testing repository by 17:50 UTC, with a clear status post on its blog . Rocky Linux and Oracle Linux had published nothing we could find.
Beyond the Red Hat family the picture was mixed. SUSE had released the SLE 15 SP7 package and had the SLES 16 package in QA. Fedora had two releases stable and two pending in Bodhi. Alpine's edge and 3.24 branches were fixed; 3.21 to 3.23 had no security-database entry. Amazon Linux listed every current stream as pending and, notably, AL2023's php8.1 and the AL2 core PHP as "No Fix Planned". The Remi repository, which php.net's advisory singled out as having no update that day, had its latest post dated October 9.
| Red Hat errata and CSAF/VEX data, the AlmaLinux blog, the Rocky Linux Apollo API, Oracle's CVE page, the Amazon Linux ALAS explorer, SUSE's CVE page, Fedora Bodhi, the Remi blog and the Alpine secdb and APKINDEX, read October 21, 2026 at the UTC time shown. | |||
|---|---|---|---|
| Distribution · stream | Fixed build or package | Status | Read (UTC) |
| --- | --- | --- | --- |
| Red Hat · RHEL 10 AppStream php (8.3) | php-8.3.36-1.el10_2 (RHSA-2026:87070) | Fixed | 20:26 |
| Red Hat · RHEL 10 php8.4 | php8.4-8.4.27-1.el10_2 (RHSA-2026:87071) | Fixed | 20:26 |
| Red Hat · RHEL 9 AppStream default php (8.0) | php-8.0.30-8.el9_8.1 (RHSA-2026:87151) | Fixed, version number unchanged | 20:26 |
| Red Hat · RHEL 8 php:7.4 module | php-7.4.33-8.module+el8.10.0+25117+30337cca (RHSA-2026:87080) | Fixed, version number unchanged | 20:26 |
| Red Hat · RHEL 8 php:8.2; RHEL 9 php:8.2, php:8.3, php:8.4 modules | Changed since: RHEL 9 php:8.2 php-8.2.35-1.module+el9.8.0+25111+a1450321 (RHSA-2026:87072, 20:35 UTC) and php:8.3 php-8.3.36-1.module+el9.8.0+25109+6886e21a (RHSA-2026:87079, 20:36 UTC); RHEL 8 php:8.2 and RHEL 9 php:8.4 still known affected (re-read 21:49 UTC) | Partly fixed (re-read) | 20:26 · 21:49 |
| Red Hat · RHEL 6 and 7 php | Changed since: RHSB-2026-013, updated 21:08 UTC, now says RHEL 7 and earlier ship PHP versions that are not affected, matching the VEX (re-read 21:49 UTC) | Not affected per vendor (re-read) | 20:41 · 21:49 |
| AlmaLinux 8 · php:7.4 | php-7.4.33-8.module_el8.10.0+4321+cf5fd4bb (rebuild of Red Hat's update) | Fixed (production repos) | 20:31 |
| AlmaLinux 8 · php:7.2, 7.3, 8.0, 8.2 | php-7.2.24-1…alma.1, php-7.3.20-1…alma.1, php-8.0.30-1…alma.1, php-8.2.33-1…alma.1 | In testing at 20:31; changed since: in production from 21:15 UTC (re-read 21:50) | 20:31 · 21:50 |
| AlmaLinux 9 · default 8.0, php:8.1, 8.2, 8.3 | php-8.0.30-8.el9_8.alma.1, php-8.1.32-1…alma.1, php-8.2.33-1…alma.1, php-8.3.33-1…alma.1 | In testing at 20:31; changed since: in production from 21:15 UTC (re-read 21:50) | 20:31 · 21:50 |
| AlmaLinux 10 · default 8.3, php8.4 | php-8.3.33-1.el10_2.alma.1 and php8.4-8.4.24-1.el10_2.alma.1 | In testing at 20:31; changed since: in production from 21:15 UTC (re-read 21:50) | 20:31 · 21:50 |
| AlmaLinux Kitten 10 | None; the fix arrives with the next regular PHP update | Pending | 20:31 |
| Rocky Linux 8, 9, 10 | None; newest Apollo advisory is RLSA-2026:85308 (bubblewrap); no PHP post or forum hit | Not published | 20:32 |
| Oracle Linux | None; the CVE page returns HTTP 404 | Not published | 20:40 |
| Amazon Linux · AL2023 php8.2, 8.3, 8.4, 8.5; AL2 Php8.2 Extra; AL2027 Preview php8.5 | None; listed as "Pending Fix", no ALAS ID | Pending | 20:38 |
| Amazon Linux · AL2023 php8.1; AL2 Core php | None; listed as "No Fix Planned" | No fix planned | 20:38 |
| SUSE · SLE 15 SP7 Web and Scripting module | php8 8.3.36-150700.3.24.1 | Fixed (released) | 20:38 |
| SUSE · SLES 16.0 and SLES for SAP 16.0 | php8 8.4.27-160000.1.1 | In testing (in QA) | 20:38 |
| SUSE · openSUSE Leap 15.4–15.6 and 16.x, SLE 15 SP4–SP6 LTSS, BCI php images, php7 | None; listed as affected | Pending | 20:38 |
| Fedora 46 and 44 | php-8.5.12-1.fc46 and php-8.5.12-1.fc44 (stable 15:31 and 16:43 UTC) | Fixed | 20:38 |
| Fedora 45 and 43 | php-8.5.12-1.fc45 and php-8.4.27-2.fc43 (Bodhi status pending) | Pending | 20:38 |
| Remi repository · remi-modular and remi-safe | None; php.net said the repo would have no update that day; latest blog post October 9 | Not published | 20:38 |
| Alpine edge and v3.24 · community | php83 8.3.36-r0, php84 8.4.27-r0, php85 8.5.12-r0 | Fixed | 20:36 |
| Alpine v3.21, v3.22, v3.23 | No secdb entry; v3.23 index still shows php83 8.3.31-r0, php84 8.4.21-r0, php85 8.5.6-r0 | Not published | 20:36 |
05 — Panels and ImagesControl panels and container images: the stack most sites actually run. #
Shared and managed hosting mostly runs PHP through a control panel's own builds, and those moved quickly. cPanel's EasyApache 4 change log for October 21 updates ea-php82 through ea-php85 to the four fixed releases and backports the fix to ea-php74, 80 and 81 without giving package strings. Plesk shipped fixed Linux and Windows builds for 8.2 to 8.5 and new builds of its end-of-life branches, while the PHP that runs the Plesk interface itself was still a planned hotfix. CloudLinux's alt-php, which many cPanel hosts layer on top, was rolling out version by version through the evening with the bulk expected by about 21:15 UTC and alt-php 8.5 by about 22:30 UTC, per its status page; TuxCare's extended-support builds were in a similar state. DirectAdmin had posted nothing.
Container and package-manager routes were the cleanest. The Docker official php image definitions were updated about twenty minutes after the release and the rebuilt tags on Docker Hub show updates from about 17:20 UTC, Homebrew had fixed formulae for every supported branch, and FrankenPHP cut v1.13.2 at 18:19 UTC. Chainguard's packages were fixed under unchanged version numbers with a new revision; the PHP Foundation says Chainguard published fixed images at 07:41 UTC, more than six hours before the coordinated release, a claim Chainguard had not addressed on its own blog by our read.
| cPanel change logs and release notes, Plesk's knowledge base and change log, DirectAdmin's changelog and forum, the CloudLinux status page and blog, TuxCare's blog, the docker-library repository and Docker Hub API, the Homebrew formula API, the Chainguard and Wolfi security feeds and the FrankenPHP release, read October 21, 2026 at the UTC time shown. | |||
|---|---|---|---|
| Panel or image · stream | Fixed build or package | Status | Read (UTC) |
| --- | --- | --- | --- |
| cPanel EasyApache 4 25.91 · ea-php85, 84, 83, 82 | ea-php85 to 8.5.12 (EA-13607), ea-php84 to 8.4.27 (EA-13608), ea-php83 to 8.3.36 (EA-13609), ea-php82 to 8.2.35 (EA-13610) | Fixed | 20:35 |
| cPanel EasyApache 4 25.91 · ea-php74, 80, 81 | Backport of both CVEs (EA-13613, EA-13612, EA-13611); package release strings not given | Fixed (backport, version number unchanged) | 20:35 |
| cPanel & WHM internal PHP (cPanel UI, Roundcube) | Versions 138.0.18, 136.0.50 and 134.0.66 include PHP 8.4.27; 110.0.153 includes backported fixes for 8.1.34 | Fixed | 20:35 |
| Plesk Obsidian · PHP for Linux 8.5, 8.4, 8.3, 8.2 | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Fixed | 20:43 |
| Plesk Obsidian · PHP for Linux 7.4, 8.0, 8.1 (end of life) | 7.4.33, 8.0.30, 8.1.34 with the same version number and a new build date; builds dated October 21, 2026 carry the fix | Fixed (same version, new build date) | 20:43 |
| Plesk Obsidian · PHP for Windows 8.2 to 8.5 | 8.2.35, 8.3.36, 8.4.27, 8.5.12 | Fixed | 20:43 |
| Plesk · sw-engine (the PHP behind the Plesk UI) | Planned as hotfix 18.0.80#11 and 18.0.81#4 | Pending | 20:43 |
| DirectAdmin · CustomBuild PHP | None; changelog 1.713 lists PHP extension updates but no PHP release; no forum announcement | Not published | 20:34 |
| CloudLinux · alt-php | Fixed per platform for 5.2, 5.6, 7.4, 8.0, 8.4 on most EL and Ubuntu targets, more on Debian 12 and 13; remaining versions rolling out, bulk expected by ~21:15 UTC, alt-php 8.5 by ~22:30 UTC; no package strings published. Changed since: a 21:45 UTC blog correction says those builds went to the TuxCare ELS alt-php repository; fixed alt-php was not yet in the CloudLinux 7, 8 and 9 repositories, and on CloudLinux 10 only alt-php 7.4 was confirmed (re-read 21:54 UTC) | Partly fixed (corrected by vendor) | 20:41 · 21:54 |
| CloudLinux · ea-php built for cPanel on CloudLinux | Changed since: released to stable at 20:55 UTC for ea-php52 to ea-php85 as backports, e.g. ea-php74 7.4.33-18.elX.cloudlinux.13 and ea-php84 8.4.26-2.elX.cloudlinux.1 (re-read 21:47 UTC) | Fixed, version number unchanged (re-read) | 20:40 · 21:47 |
| TuxCare · ELS and ESU (distribution PHP, Endless Lifecycle Support) | Fixed now for RHEL 7, Oracle 6 and 7, CentOS 8.4 and 8.5, CentOS Stream 8, Amazon Linux 2, AlmaLinux 9.2 and 9.8 ESU, Ubuntu 16.04, 18.04 and 20.04 ELS, Alpine 3.18 ELS; releasing for CloudLinux 7 and Debian 11 ELS; CentOS 6 and 7, Debian 10 ELS and PHP for Windows next; no package strings | Partly fixed | 20:41 |
| Docker Official Images · php (Debian and Alpine variants) | Tags 8.5.12-, 8.4.27-, 8.3.36-, 8.2.35- (for example php:8.4.27-fpm, php:8.4-apache); 8.6-rc points to 8.6.0RC4; no 8.1-or-older tags are maintained | Fixed | 20:28 |
| Homebrew · php, php@8.4, php@8.3, php@8.2 | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Fixed | 20:31 |
| Homebrew · php@8.1 (deprecated Dec 31, 2025) | Still 8.1.34, last changed October 13 | Not published | 20:31 |
| Chainguard / Wolfi · php-8.2, 8.3, 8.4, 8.5 packages | php-8.2 8.2.34-r4, php-8.3 8.3.35-r4, php-8.4 8.4.26-r4, php-8.5 8.5.11-r4, each listed against both CVEs | Fixed (version number unchanged) | 20:36 |
| FrankenPHP · v1.13.2 | Docker images with PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; static binaries with 8.5.12 | Fixed | 20:40 |
06 — Managed HostsManaged platforms: patched, patching, or silent. #
A managed host is the one case where the customer cannot act alone, so what the host had said by the evening of release day is the whole story. Pantheon said all live production sites on 8.2 to 8.5 were patched. Laravel Cloud patched running apps in place, but Laravel's own knowledge base warns that Forge's automatic security updates do not patch PHP, so Forge customers must update their servers themselves. Microsoft's App Service on Linux had fixed built-in images on two of its three release channels. Google Cloud's bulletin lists the fixed versions and says some workloads may be patched automatically while advising a redeploy; our security changes post uses that three-answers-from-one-cloud pattern as the reason to put runtime patching in writing.
The WordPress-specialist hosts were the mixed group. Automattic said its hosted WordPress service, VIP, WP Cloud and Pressable were already protected without naming a PHP version. WP Engine and Kinsta both had patching in progress, Kinsta with 8.5, 8.3 and 8.0 rolling out and 8.4, 8.2, 8.1 and 7.4 still in validation. SiteGround's post was last updated before the release and covered only mitigations. Acquia had disabled management services while waiting for an operating-system update from AWS, and AWS's own bulletin feed had no PHP item at 19:54 UTC. Hosts not in the table had published nothing we could find; absence here is a fact about our search, not about their servers.
| Laravel's blog and Forge knowledge base, Automattic's blog, the WP Engine, Kinsta, Pantheon and Acquia status pages, SiteGround's blog, Google Cloud's security bulletins, the Azure App Service blog and AWS's bulletin feed, read October 21, 2026 at the UTC time shown. Hosts that had published nothing by then are not listed. | |||
|---|---|---|---|
| Platform | Fixed build or package | Status | Read (UTC) |
| --- | --- | --- | --- |
| Laravel Cloud | Running apps patched in place to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 | Fixed | 20:37 |
| Laravel Forge (servers use Sury packages or a mirror of the PPA) | Sury builds; Forge's automatic security updates do not patch PHP, so the customer must update; Laravel said at 20:35 UTC that all versions except 24.04 had patches. Changed since: its 20:49 UTC update tells 8.2 to 8.5 users to run Update PHP and says no patch is available for 8.0 or 8.1 (re-read 21:54 UTC) | Partly fixed, customer action required | 20:37 · 21:54 |
| Laravel Vapor | Native runtimes updated for 8.2 to 8.5; a redeploy is needed; no patches for PHP 7. Changed since: the 20:49 UTC update says no patch is available for PHP 8.0 or 8.1 (re-read 21:54 UTC) | Fixed (redeploy required) | 20:37 · 21:54 |
| Laravel Herd | None; no changelog entry | Not published | 20:40 |
| Automattic · hosted WordPress service, WordPress VIP, WP Cloud, Pressable, Tumblr | No PHP version named; the post says sites are already protected with no action required | Protected per vendor (no build named) | 20:37 |
| WP Engine | "Currently deploying patches to the platform"; no versions named | In progress | 20:39 |
| Kinsta | 8.5, 8.3 and 8.0 rolling out; 8.4, 8.2, 8.1 and 7.4 still in validation. Changed since: at 21:17 UTC 7.4 joined the rollout; 8.4, 8.2 and 8.1 still in validation (re-read 21:47 UTC) | In progress | 20:37 · 21:47 |
| Pantheon · PHP 8.2 to 8.5 | 8.5.12, 8.4.27, 8.3.36, 8.2.35 on all live production sites running supported versions | Fixed (live production) | 20:37 |
| Pantheon · heirloom 8.1.x to 5.6.x | Via its LTS vendor once the patches are backported. Changed since: at 21:32 UTC Pantheon said it had received the LTS updates and was deploying them (re-read 21:47 UTC) | In progress (re-read) | 20:37 · 21:47 |
| SiteGround | No fixed build named; the post, last updated 11:30 UTC, covers pre-release mitigations only | Not published (fixed build) | 20:38 |
| Acquia Cloud Platform | Management services disabled while waiting for an operating-system update from AWS | Pending | 20:37 |
| Google Cloud · App Engine Standard, Cloud Run, Cloud Run functions (GCP-2026-070) | Lists 8.5.12, 8.4.27, 8.3.36, 8.2.35; some workloads patched automatically, redeploy advised; no per-runtime version | Partly fixed | 20:37 |
| Microsoft Azure · App Service on Linux built-in PHP images | 8.2.35, 8.3.36, 8.4.27, 8.5.12 on the Latest and Standard release channels; the Extended channel receives the fix last | Fixed (two of three channels) | 20:37 |
| AWS · security bulletins (Elastic Beanstalk, Lightsail not named at first read) | None; the bulletin feed had no PHP item at 19:54 UTC. Changed since: bulletin 2026-143-AWS at 21:30 UTC says Elastic Beanstalk PHP platform v4.13.12 shipped October 21, Lightsail blueprints were due October 21 and Amazon Linux packages are targeted for October 22 (re-read 21:53 UTC) | In progress (re-read) | 20:38 · 21:53 |
07 — End of LifePHP 8.1 and older: four routes to a fix, none from php.net. #
WordPress.org's PHP statistics, read October 21, put 36.4% of reporting installs on PHP 8.1 or older. For those sites the question is not which release to install but which vendor can supply a backport at all. The table above gives four answers. The grid below sorts them by who you would have to be to use each one. The sorting is ours; the facts are the vendors'.
A distribution with extended support
Fixed 7.4, 7.2, 7.0 and even 5.5 packages exist for Ubuntu Pro subscribers, and Red Hat and AlmaLinux ship a fixed php:7.4 module. TuxCare's extended-lifecycle builds were releasing through the evening. The version number stays old; the package revision moves.
A third-party package repository
Backported packages for every branch down to 5.6, published on release day with the upstream patch in the source. The php7.4 and php8.1 changelogs name both CVEs one entry below a snapshot note, so read past the top entry or compare the package string with the table.
A control panel's own builds
cPanel backported to ea-php74, 80 and 81; Plesk rebuilt 7.4.33, 8.0.30 and 8.1.34 with an October 21 build date; CloudLinux was rolling out alt-php by platform, though its 21:45 UTC correction said fixed alt-php was not yet in its CloudLinux 7 to 9 repositories. On a panel server, the panel's update is the fix.
Build it yourself from the backport branch
The PHP security team's branches carry one commit each and no release. This route exists for people who already compile PHP; it is not a path a typical site owner should start on this week.
Several vendors said no outright. Amazon Linux lists AL2023's php8.1 and the AL2 core PHP as "No Fix Planned"; Microsoft says end-of-life PHP versions on App Service will not receive these patches; Google Cloud says its unsupported runtimes will not be patched; and Laravel's post, updated at 20:49 UTC, says no patch is available for PHP 8.0 or 8.1 on Forge or Vapor. For anyone on those, the fix is a migration, and the PHP 8.2 branch they would move to loses its own security support on December 31, 2026, so the sensible target is 8.3 or later.
08 — VerificationHow to check which build your site really runs. #
The command-line php binary, PHP-FPM, Apache's mod_php and LiteSpeed can come from different packages, and a Sury, Plesk, cPanel or CloudLinux server routinely has several PHP versions installed side by side. So php -v reports the CLI binary on your path, which may not be the one serving your site. Check the package behind each site's handler, compare the full package string to the row in the tables above, and then restart every worker, because a running PHP-FPM pool, Apache process or queue worker keeps the old code in memory until it is restarted. The commands below are generic; the paths for panel-managed PHP are the ones each vendor documents.
dpkg -l 'php*' | awk '/^ii/ {print $2, $3}'
apt-cache policy php8.4-fpm # installed, candidate and source repo
rpm -q php php-cli php-fpm # php8.4 on RHEL 10; php8 on SUSE
rpm -q --changelog php | grep -E 'CVE-2026-10961[89]'
dnf module list php # EL8/EL9: which php:X.Y stream is enabled
apk info -v | grep '^php8'
php -i | grep -E '^(PHP Version|Server API|Build Date)'
docker exec <container> php -v
Two cautions. On Sury's legacy builds the newest changelog entry is a snapshot note and the CVE line sits one entry below it, so read the whole entry list or compare the package string, not the top entry alone. And CloudLinux said on its status page that the updateinfo metadata for alt-php was not yet published, so a dnf query by CVE would miss its packages at our read time.
09 — MethodologyHow the table was built, and how to redo it. #
Every row is a vendor's own statement; nothing here is our test of a server.
- What was collected
- One row per source of a PHP build: the PHP project, each distribution and its extended-support programme, third-party package repositories, control panels, container images and package managers, and managed platforms that had published a statement. For each: the fixed version or exact package string where the vendor gave one, a status label, and the UTC time the page was read.
- Sources
- Vendor advisories, security trackers, errata and CSAF/VEX data, status pages and their APIs, blog posts, and package indexes read directly (Debian and Sury Packages and Sources files, the Launchpad API, Alpine's secdb and APKINDEX, the Chainguard and Wolfi security feeds, Fedora Bodhi, the docker-library repository and Docker Hub API, the Homebrew formula API, windows.php.net's releases.json). No press coverage and no aggregator was used as a source for any cell.
- As-of date
- Every row was read between 20:22 and 20:44 UTC on October 21, 2026, about six to seven hours after the PHP release, and carries its own read time. The post is dated October 22; the data is not. The CISA KEV feed was re-read at 21:10 UTC the same day and listed neither CVE. Rows marked re-read were checked again between 21:47 and 21:55 UTC after vendors updated them; the summary counts and takeaways describe the first read.
- Status labels
- Fixed, Partly fixed, In testing, In progress, Pending, Not published and Conflicting, defined in the callout above. A fixed status is the vendor's claim that a build is released; we did not install or test any package.
- Package strings
- Printed exactly as the vendor's index or advisory shows them, with long Sury and AlmaLinux strings truncated after the identifying date stamp, Ubuntu series tag or module hash. Where a vendor named no string (cPanel's legacy backports, CloudLinux, TuxCare, Plesk's end-of-life builds) the row says so rather than inferring one.
- What could not be resolved
- Red Hat's bulletin and VEX disagreed on RHEL 7 at our read; the bulletin's 21:08 UTC update now matches the VEX. Alpine maps CVE-2026-109619 to a different GHSA identifier from php.net's. The PHP Foundation's 07:41 UTC Chainguard claim is the Foundation's; Chainguard had not commented. Cloudflare's "about 9 hours ahead" and its 03:02 UTC timestamp do not reconcile with a 14:00 UTC release, so only the timestamp is used. Akamai, Imperva, AWS WAF, Sucuri, LiteSpeed, Gentoo, Arch and FreeBSD were not checked.
- Refresh
- Maintained by the Digital Applied Team. The table will be re-read once more during the week of October 26, 2026 to close the pending and not-published rows, and the as-of row and cite line updated with that date. Rows are never re-dated without being re-read.
If you run client sites across several of these stacks, this is the table to work down on Monday, row by row, with the package string in one hand and the host's status page in the other. Our web development team does exactly that for the WordPress and WooCommerce estates we maintain; the wider WordPress version picture is in our WordPress statistics reference, and the last comparable runtime scramble, in WooCommerce, is in our WooCommerce 11.0.1 patch note.
10 — ConclusionSeventy-six rows, one habit. #
Find your row, compare the full package string, restart every worker, and re-check the rows marked pending.
By the evening of release day the PHP project, Debian, Ubuntu, Sury, Red Hat, SUSE, Fedora, Alpine, cPanel, Plesk, Docker, Homebrew and several managed platforms had shipped fixed builds. AlmaLinux was in testing, CloudLinux and TuxCare were rolling out, and Rocky, Oracle, Remi, DirectAdmin, Amazon Linux and AWS had either nothing or a pending notice.
Fifteen of the fixed rows keep an old PHP version number. That is the single most useful thing to know this week: the fix is in the package revision or the build date, and php -v on its own will mislead you in both directions. Check the string your vendor lists, check it for the PHP that actually serves the site rather than the one on your shell path, and restart the workers.