PHP2Shell Fixes by Distro, Control Panel and PHP Version The PHP project released fixes for PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026, with Linux distributions and long-term-support vendors receiving the patches in advance. A vendor-by-vendor audit found that 15 fixed builds kept their original PHP version numbers — including all eight Ubuntu rows, RHEL 9 and RHEL 8, AlmaLinux 8's php:7.4, Sury's legacy packages, cPanel's 7.4 to 8.1 backports, Plesk's end-of-life builds and Chainguard — so administrators must check the package revision or build date rather than php -v output. Debian stable and LTS, every current Ubuntu release and Ubuntu Pro, Red Hat's four main streams, SUSE SLE 15 SP7, Fedora 46 and 44 and Alpine 3.24 had fixed packages by 20:44 UTC, while Rocky and Oracle had published nothing and AWS had no bulletin by 19:54 UTC. The PHP project fixed PHP2Shell, CVE-2026-109618 and CVE-2026-109619, in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026. Its advisory then says the part most readers skip: Linux distributions and long-term-support vendors received the patches in advance, so check your vendor for updated packages. If you do not build PHP from source, the version your site runs comes from one of roughly a dozen kinds of vendor, and this page is a dated record of what each had shipped by the evening of release day, read from the vendor's own page, feed or package index. What the bug is and why it matters is in our PHP2Shell patch-now post https://www.digitalapplied.com/blog/php2shell-critical-php-vulnerabilities-patch-now ; what this week should change in how you patch is in our security changes for 2026 https://www.digitalapplied.com/blog/website-security-after-php2shell-ai-era-2026 . One finding runs through every table. Many vendors ship the fix without changing the PHP version number. Ubuntu 24.04's fixed package is still called 8.3.6, Red Hat's RHEL 9 default PHP is still 8.0.30, Sury's legacy builds still say 7.4.33 and 8.1.34, Chainguard's fixed package is 8.4.26 with a new revision suffix, and Plesk's fix for its end-of-life 7.4, 8.0 and 8.1 builds keeps the same version and changes only the build date. So a lower number can be fixed and an unchanged number can hide either state. Check the package or build string your vendor lists, not the output of php -v alone. 1. 01Check the package string your vendor names, not php -v.Fifteen rows in this table are fixed builds whose PHP version number did not change: all eight Ubuntu rows, RHEL 9 and RHEL 8, AlmaLinux 8's php:7.4, Sury's legacy packages, cPanel's 7.4 to 8.1 backports, Plesk's end-of-life builds and Chainguard. The fix is in the package revision or the build date. 2. 02The big distributions shipped on release day; the clones mostly did not.Debian stable and LTS, every current Ubuntu release and Ubuntu Pro, Red Hat's four main streams, SUSE SLE 15 SP7, Fedora 46 and 44 and Alpine 3.24 all had fixed packages by 20:44 UTC. AlmaLinux had one stream in production and the rest in testing; Rocky and Oracle had published nothing. 3. 03PHP 8.1 and older have no upstream release, only backports.The PHP security team published source-only patch branches for 7.4, 8.0 and 8.1. Binaries for those versions come from Ubuntu Pro, Sury, Red Hat, cPanel, Plesk, CloudLinux or TuxCare, each on its own schedule and under the old version number. 4. 04Control panels moved fast; the panel's own PHP lagged.cPanel and Plesk both shipped fixed builds for every supported and several end-of-life branches on October 21. Plesk's own sw-engine PHP was still a planned hotfix, DirectAdmin had posted nothing, and CloudLinux's alt-php was rolling out through the evening. 5. 05Managed hosts split three ways: patched, patching, or silent.Pantheon, Laravel Cloud and Azure App Service named fixed versions. WP Engine and Kinsta said patching was in progress. SiteGround's post predated the release, Acquia was waiting on AWS, and AWS itself had no bulletin by 19:54 UTC. 01 — Version NumbersA lower number can be fixed , and an unchanged one can hide either state. Distributions and long-term-support vendors do not usually upgrade a package to the newest upstream release. They take the fix commit, apply it to the version they already ship, and bump the package revision. That is why Ubuntu 24.04's fixed PHP is 8.3.6-0ubuntu0.24.04.13 rather than 8.3.36, and why AlmaLinux 9's testing build is php-8.3.33 rather than 8.3.36. The upstream number says which release the source came from; the suffix says what the vendor has done to it since. Plesk's knowledge-base article states the extreme case in one sentence: its fixes for the end-of-life 7.4.33, 8.0.30 and 8.1.34 builds "have the same version number, but different build date", and builds dated October 21, 2026 include the fix. The failure case is the obvious one. An administrator runs php -v, sees 8.3.6 on a patched Ubuntu server, compares it to the 8.3.36 in the advisory and upgrades by hand to a third-party build; or sees 7.4.33 on a Plesk server, assumes nothing has changed, and leaves a fixed server flagged as vulnerable while a genuinely unpatched one with the same number sits next to it. The six examples below are the rows where that confusion is most likely. | Six fixed builds that keep an older PHP version number, from the vendor pages and package indexes listed in the tables below, read October 21, 2026. | | | | |---|---|---|---| | Vendor | Looks like | Fixed package | Where the fix shows | |---|---|---|---| | Ubuntu 24.04 LTS | 8.3.6 | 8.3.6-0ubuntu0.24.04.13 | Package revision; USN-8948-1 | | Red Hat RHEL 8, php:7.4 | 7.4.33 | php-7.4.33-8.module+el8.10.0+25117+30337cca | Package release; RHSA-2026:87080 | | AlmaLinux 9, php:8.3 | 8.3.33 | php-8.3.33-1.module el9.8.0+328+1fdeb728.alma.1 | Package release; testing at 20:31, production from 21:15 UTC | | Sury, Debian 13, php8.1 | 8.1.34 | 8.1.34-9+0~20261021.82+debian13~1 | Date stamp in the revision; bailout patch in the source | | Chainguard / Wolfi php-8.4 | 8.4.26 | 8.4.26-r4 | Revision suffix; listed against both CVEs in the security feed | | Plesk, PHP 7.4 / 8.0 / 8.1 | 7.4.33 / 8.0.30 / 8.1.34 | Same version, built October 21, 2026 | Build date only, per Plesk's knowledge base | 02 — UpstreamThe PHP project: four releases, three source backports . The php.net advisory https://www.php.net/archive/2026.php 2026-10-21-5 names four fixed releases and states that PHP 8.1 and older no longer receive updates from the project. What it adds, and what most coverage omits, is that the security team published minimal source backports for 7.4, 8.0 and 8.1 for people who build from source or have no long-term-support vendor. Those are git branches in the php-src repository with a single commit each, dated October 18; there is no tarball, no binary and no version bump. Windows builds for 8.2 to 8.5 were on windows.php.net by 13:49 UTC, just ahead of the scheduled release; the Windows 7.4, 8.0 and 8.1 builds were untouched. | PHP project pages, the php-src repository and windows.php.net, read October 21, 2026 at the UTC time shown. Upstream version numbers are the fixed versions; a vendor build may carry a lower number and still include the fix. | | | | |---|---|---|---| | PHP project source | Fixed build or package | Status | Read UTC | |---|---|---|---| | PHP project · PHP 8.5 | 8.5.12 | Fixed | 20:23 | | PHP project · PHP 8.4 | 8.4.27 | Fixed | 20:23 | | PHP project · PHP 8.3 | 8.3.36 | Fixed | 20:23 | | PHP project · PHP 8.2 security support ends Dec 31, 2026 | 8.2.35 | Fixed | 20:23 | | PHP project · PHP 8.6.0 RC4 pre-release, not for production | 8.6.0RC4; its NEWS file names both CVEs | Fixed pre-release | 20:28 | | PHP security team · PHP 7.4, 8.0, 8.1 | Source-only branches PHP-7.4-, PHP-8.0- and PHP-8.1-CVE-2026-109618-109619; no tarball, binary or version bump | Fixed source patch for people who build PHP | 20:27 | | windows.php.net · 8.2 to 8.5 | php-8.5.12, 8.4.27, 8.3.36 and 8.2.35 Win32 zips x64, x86, NTS | Fixed | 20:28 | | windows.php.net · 7.4, 8.0, 8.1 | Latest builds still 7.4.33, 8.0.30 and 8.1.34, unchanged since 2024–2025 | Not published | 20:28 | 03 — Debian FamilyDebian, Ubuntu and Sury: fixed on release day, under the old numbers . Debian's security team published DSA-6574-1 for trixie at 13:45 UTC, fifteen minutes before the scheduled release, and the LTS team followed for bookworm at 14:11 UTC. Canonical's USN-8948-1 covers every current Ubuntu release and USN-8948-2 covers the Ubuntu Pro releases back to 14.04, which means a 2014 PHP 5.5 package received this fix. Ubuntu ships no php8.2 or php8.4 of its own; those come from Ondřej Surý's repository and PPA, which published fixed 8.5 to 8.2 packages and backported the fix to every legacy branch down to 5.6, each carrying the upstream bailout patch. One wrinkle for anyone reading changelogs: the newest entry in Sury's php7.4 and php8.1 changelogs is a snapshot note, and the line naming both CVEs sits one entry below it. | Debian security and LTS announcements, the Debian security tracker, Freexian's ELTS tracker, Ubuntu's USN-8948-1 and USN-8948-2, and the Sury repository and PPA package indexes, read October 21, 2026 at the UTC time shown. Sury strings are truncated after the date stamp. | | | | |---|---|---|---| | Distribution · package | Fixed build or package | Status | Read UTC | |---|---|---|---| | Debian 13 trixie stable · php8.4 | 8.4.27-1~deb13u1 DSA-6574-1 | Fixed | 20:25 | | Debian 12 bookworm LTS · php8.2 | 8.2.35-1~deb12u1 DLA-4848-1 | Fixed | 20:25 | | Debian forky testing and sid · php8.4 | 8.4.26-1 listed as vulnerable, fixed version " unfixed " | Pending | 20:23 | | Freexian Debian ELTS · 11 bullseye php7.4, 10 buster php7.3, 9 stretch php7.0 | Changed since: ELA-1853-1 php7.4 7.4.33-1+deb11u14, ELA-1854-1 php7.3 7.3.31-1~deb10u16 and ELA-1855-1 php7.0 7.0.33-0+deb9u26, dated October 21 re-read 21:55 UTC | Fixed re-read | 20:39 · 21:55 | | Ubuntu 26.10 · php8.5 | 8.5.9-0ubuntu2.1 USN-8948-1 | Fixed | 20:24 | | Ubuntu 26.04 LTS · php8.5 | 8.5.4-0ubuntu1.5 USN-8948-1 | Fixed | 20:24 | | Ubuntu 24.04 LTS · php8.3 | 8.3.6-0ubuntu0.24.04.13 USN-8948-1 | Fixed, version number unchanged | 20:24 | | Ubuntu 22.04 LTS · php8.1 | 8.1.2-1ubuntu2.28 USN-8948-1 | Fixed, version number unchanged | 20:24 | | Ubuntu Pro 20.04 · php7.4 | 7.4.3-4ubuntu2.29+esm5 USN-8948-2 | Fixed, Ubuntu Pro only | 20:24 | | Ubuntu Pro 18.04 · php7.2 | 7.2.24-0ubuntu0.18.04.17+esm14 USN-8948-2 | Fixed, Ubuntu Pro only | 20:24 | | Ubuntu Pro Legacy 16.04 · php7.0 | 7.0.33-0ubuntu0.16.04.16+esm22 USN-8948-2 | Fixed, Pro with Legacy Support only | 20:24 | | Ubuntu Pro Legacy 14.04 · php5 | 5.5.9+dfsg-1ubuntu4.29+esm18 USN-8948-2 | Fixed, Pro with Legacy Support only | 20:24 | | Sury repository · Debian 13 and 12, php8.5 to php8.2 | 8.5.12-1+0~20261021…, 8.4.27-1+0~20261021…, 8.3.36-1+0~20261021…, 8.2.35-1+0~20261021… | Fixed | 20:26 | | Sury repository · Debian 13 and 12, php8.1 down to php5.6 | 8.1.34-9+0~20261021…, 1:8.0.30-25+…, 1:7.4.33-31+…, 7.3.33-35+…, 7.2.34-66+…, 7.1.33-80+…, 7.0.33-92+…, 5.6.40-104+…; each carries the bailout patch | Fixed backport, version number unchanged | 20:27 | | Sury Launchpad PPA ondrej/php · Ubuntu 24.04 and 22.04, 8.5 to 7.4 | 8.5.12-1+ubuntu24.04.1+… and matching 8.4.27, 8.3.36, 8.2.35, 8.1.34-9, 7.4.33-31 strings; jammy uses +ubuntu22.04.1; no 26.04 series | Fixed | 20:27 | 04 — RPM WorldRed Hat shipped, the clones were still in testing . Red Hat's errata landed through the afternoon, RHEL 8's php:7.4 module at 15:53 UTC and the RHEL 10 and 9 defaults around 20:10 UTC. Its own security bulletin notes that standard RHEL deployments use PHP-FPM rather than mod php, which is the lower-risk configuration in php.net's reading. Two gaps remained at our read: the php:8.2, 8.3 and 8.4 module streams on RHEL 8 and 9 were listed in Red Hat's VEX data as affected with no remediation available, and RHEL 7 was listed as affected in the bulletin but not affected in the VEX. AlmaLinux, which rebuilds Red Hat's updates, had the php:7.4 rebuild in production and everything else in its testing repository by 17:50 UTC, with a clear status post on its blog . Rocky Linux and Oracle Linux had published nothing we could find. Beyond the Red Hat family the picture was mixed. SUSE had released the SLE 15 SP7 package and had the SLES 16 package in QA. Fedora had two releases stable and two pending in Bodhi. Alpine's edge and 3.24 branches were fixed; 3.21 to 3.23 had no security-database entry. Amazon Linux listed every current stream as pending and, notably, AL2023's php8.1 and the AL2 core PHP as "No Fix Planned". The Remi repository, which php.net's advisory singled out as having no update that day, had its latest post dated October 9. | Red Hat errata and CSAF/VEX data, the AlmaLinux blog, the Rocky Linux Apollo API, Oracle's CVE page, the Amazon Linux ALAS explorer, SUSE's CVE page, Fedora Bodhi, the Remi blog and the Alpine secdb and APKINDEX, read October 21, 2026 at the UTC time shown. | | | | |---|---|---|---| | Distribution · stream | Fixed build or package | Status | Read UTC | |---|---|---|---| | Red Hat · RHEL 10 AppStream php 8.3 | php-8.3.36-1.el10 2 RHSA-2026:87070 | Fixed | 20:26 | | Red Hat · RHEL 10 php8.4 | php8.4-8.4.27-1.el10 2 RHSA-2026:87071 | Fixed | 20:26 | | Red Hat · RHEL 9 AppStream default php 8.0 | php-8.0.30-8.el9 8.1 RHSA-2026:87151 | Fixed, version number unchanged | 20:26 | | Red Hat · RHEL 8 php:7.4 module | php-7.4.33-8.module+el8.10.0+25117+30337cca RHSA-2026:87080 | Fixed, version number unchanged | 20:26 | | Red Hat · RHEL 8 php:8.2; RHEL 9 php:8.2, php:8.3, php:8.4 modules | Changed since: RHEL 9 php:8.2 php-8.2.35-1.module+el9.8.0+25111+a1450321 RHSA-2026:87072, 20:35 UTC and php:8.3 php-8.3.36-1.module+el9.8.0+25109+6886e21a RHSA-2026:87079, 20:36 UTC ; RHEL 8 php:8.2 and RHEL 9 php:8.4 still known affected re-read 21:49 UTC | Partly fixed re-read | 20:26 · 21:49 | | Red Hat · RHEL 6 and 7 php | Changed since: RHSB-2026-013, updated 21:08 UTC, now says RHEL 7 and earlier ship PHP versions that are not affected, matching the VEX re-read 21:49 UTC | Not affected per vendor re-read | 20:41 · 21:49 | | AlmaLinux 8 · php:7.4 | php-7.4.33-8.module el8.10.0+4321+cf5fd4bb rebuild of Red Hat's update | Fixed production repos | 20:31 | | AlmaLinux 8 · php:7.2, 7.3, 8.0, 8.2 | php-7.2.24-1…alma.1, php-7.3.20-1…alma.1, php-8.0.30-1…alma.1, php-8.2.33-1…alma.1 | In testing at 20:31; changed since: in production from 21:15 UTC re-read 21:50 | 20:31 · 21:50 | | AlmaLinux 9 · default 8.0, php:8.1, 8.2, 8.3 | php-8.0.30-8.el9 8.alma.1, php-8.1.32-1…alma.1, php-8.2.33-1…alma.1, php-8.3.33-1…alma.1 | In testing at 20:31; changed since: in production from 21:15 UTC re-read 21:50 | 20:31 · 21:50 | | AlmaLinux 10 · default 8.3, php8.4 | php-8.3.33-1.el10 2.alma.1 and php8.4-8.4.24-1.el10 2.alma.1 | In testing at 20:31; changed since: in production from 21:15 UTC re-read 21:50 | 20:31 · 21:50 | | AlmaLinux Kitten 10 | None; the fix arrives with the next regular PHP update | Pending | 20:31 | | Rocky Linux 8, 9, 10 | None; newest Apollo advisory is RLSA-2026:85308 bubblewrap ; no PHP post or forum hit | Not published | 20:32 | | Oracle Linux | None; the CVE page returns HTTP 404 | Not published | 20:40 | | Amazon Linux · AL2023 php8.2, 8.3, 8.4, 8.5; AL2 Php8.2 Extra; AL2027 Preview php8.5 | None; listed as "Pending Fix", no ALAS ID | Pending | 20:38 | | Amazon Linux · AL2023 php8.1; AL2 Core php | None; listed as "No Fix Planned" | No fix planned | 20:38 | | SUSE · SLE 15 SP7 Web and Scripting module | php8 8.3.36-150700.3.24.1 | Fixed released | 20:38 | | SUSE · SLES 16.0 and SLES for SAP 16.0 | php8 8.4.27-160000.1.1 | In testing in QA | 20:38 | | SUSE · openSUSE Leap 15.4–15.6 and 16.x, SLE 15 SP4–SP6 LTSS, BCI php images, php7 | None; listed as affected | Pending | 20:38 | | Fedora 46 and 44 | php-8.5.12-1.fc46 and php-8.5.12-1.fc44 stable 15:31 and 16:43 UTC | Fixed | 20:38 | | Fedora 45 and 43 | php-8.5.12-1.fc45 and php-8.4.27-2.fc43 Bodhi status pending | Pending | 20:38 | | Remi repository · remi-modular and remi-safe | None; php.net said the repo would have no update that day; latest blog post October 9 | Not published | 20:38 | | Alpine edge and v3.24 · community | php83 8.3.36-r0, php84 8.4.27-r0, php85 8.5.12-r0 | Fixed | 20:36 | | Alpine v3.21, v3.22, v3.23 | No secdb entry; v3.23 index still shows php83 8.3.31-r0, php84 8.4.21-r0, php85 8.5.6-r0 | Not published | 20:36 | 05 — Panels and ImagesControl panels and container images: the stack most sites actually run . Shared and managed hosting mostly runs PHP through a control panel's own builds, and those moved quickly. cPanel's EasyApache 4 change log for October 21 updates ea-php82 through ea-php85 to the four fixed releases and backports the fix to ea-php74, 80 and 81 without giving package strings. Plesk shipped fixed Linux and Windows builds for 8.2 to 8.5 and new builds of its end-of-life branches, while the PHP that runs the Plesk interface itself was still a planned hotfix. CloudLinux's alt-php, which many cPanel hosts layer on top, was rolling out version by version through the evening with the bulk expected by about 21:15 UTC and alt-php 8.5 by about 22:30 UTC, per its status page; TuxCare's extended-support builds were in a similar state. DirectAdmin had posted nothing. Container and package-manager routes were the cleanest. The Docker official php image definitions were updated about twenty minutes after the release and the rebuilt tags on Docker Hub show updates from about 17:20 UTC, Homebrew had fixed formulae for every supported branch, and FrankenPHP cut v1.13.2 at 18:19 UTC. Chainguard's packages were fixed under unchanged version numbers with a new revision; the PHP Foundation says Chainguard published fixed images at 07:41 UTC, more than six hours before the coordinated release, a claim Chainguard had not addressed on its own blog by our read. | cPanel change logs and release notes, Plesk's knowledge base and change log, DirectAdmin's changelog and forum, the CloudLinux status page and blog, TuxCare's blog, the docker-library repository and Docker Hub API, the Homebrew formula API, the Chainguard and Wolfi security feeds and the FrankenPHP release, read October 21, 2026 at the UTC time shown. | | | | |---|---|---|---| | Panel or image · stream | Fixed build or package | Status | Read UTC | |---|---|---|---| | cPanel EasyApache 4 25.91 · ea-php85, 84, 83, 82 | ea-php85 to 8.5.12 EA-13607 , ea-php84 to 8.4.27 EA-13608 , ea-php83 to 8.3.36 EA-13609 , ea-php82 to 8.2.35 EA-13610 | Fixed | 20:35 | | cPanel EasyApache 4 25.91 · ea-php74, 80, 81 | Backport of both CVEs EA-13613, EA-13612, EA-13611 ; package release strings not given | Fixed backport, version number unchanged | 20:35 | | cPanel & WHM internal PHP cPanel UI, Roundcube | Versions 138.0.18, 136.0.50 and 134.0.66 include PHP 8.4.27; 110.0.153 includes backported fixes for 8.1.34 | Fixed | 20:35 | | Plesk Obsidian · PHP for Linux 8.5, 8.4, 8.3, 8.2 | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Fixed | 20:43 | | Plesk Obsidian · PHP for Linux 7.4, 8.0, 8.1 end of life | 7.4.33, 8.0.30, 8.1.34 with the same version number and a new build date; builds dated October 21, 2026 carry the fix | Fixed same version, new build date | 20:43 | | Plesk Obsidian · PHP for Windows 8.2 to 8.5 | 8.2.35, 8.3.36, 8.4.27, 8.5.12 | Fixed | 20:43 | | Plesk · sw-engine the PHP behind the Plesk UI | Planned as hotfix 18.0.80 11 and 18.0.81 4 | Pending | 20:43 | | DirectAdmin · CustomBuild PHP | None; changelog 1.713 lists PHP extension updates but no PHP release; no forum announcement | Not published | 20:34 | | CloudLinux · alt-php | Fixed per platform for 5.2, 5.6, 7.4, 8.0, 8.4 on most EL and Ubuntu targets, more on Debian 12 and 13; remaining versions rolling out, bulk expected by ~21:15 UTC, alt-php 8.5 by ~22:30 UTC; no package strings published. Changed since: a 21:45 UTC blog correction says those builds went to the TuxCare ELS alt-php repository; fixed alt-php was not yet in the CloudLinux 7, 8 and 9 repositories, and on CloudLinux 10 only alt-php 7.4 was confirmed re-read 21:54 UTC | Partly fixed corrected by vendor | 20:41 · 21:54 | | CloudLinux · ea-php built for cPanel on CloudLinux | Changed since: released to stable at 20:55 UTC for ea-php52 to ea-php85 as backports, e.g. ea-php74 7.4.33-18.elX.cloudlinux.13 and ea-php84 8.4.26-2.elX.cloudlinux.1 re-read 21:47 UTC | Fixed, version number unchanged re-read | 20:40 · 21:47 | | TuxCare · ELS and ESU distribution PHP, Endless Lifecycle Support | Fixed now for RHEL 7, Oracle 6 and 7, CentOS 8.4 and 8.5, CentOS Stream 8, Amazon Linux 2, AlmaLinux 9.2 and 9.8 ESU, Ubuntu 16.04, 18.04 and 20.04 ELS, Alpine 3.18 ELS; releasing for CloudLinux 7 and Debian 11 ELS; CentOS 6 and 7, Debian 10 ELS and PHP for Windows next; no package strings | Partly fixed | 20:41 | | Docker Official Images · php Debian and Alpine variants | Tags 8.5.12- , 8.4.27- , 8.3.36- , 8.2.35- for example php:8.4.27-fpm, php:8.4-apache ; 8.6-rc points to 8.6.0RC4; no 8.1-or-older tags are maintained | Fixed | 20:28 | | Homebrew · php, php@8.4, php@8.3, php@8.2 | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Fixed | 20:31 | | Homebrew · php@8.1 deprecated Dec 31, 2025 | Still 8.1.34, last changed October 13 | Not published | 20:31 | | Chainguard / Wolfi · php-8.2, 8.3, 8.4, 8.5 packages | php-8.2 8.2.34-r4, php-8.3 8.3.35-r4, php-8.4 8.4.26-r4, php-8.5 8.5.11-r4, each listed against both CVEs | Fixed version number unchanged | 20:36 | | FrankenPHP · v1.13.2 | Docker images with PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; static binaries with 8.5.12 | Fixed | 20:40 | 06 — Managed HostsManaged platforms: patched, patching, or silent . A managed host is the one case where the customer cannot act alone, so what the host had said by the evening of release day is the whole story. Pantheon said all live production sites on 8.2 to 8.5 were patched. Laravel Cloud patched running apps in place, but Laravel's own knowledge base warns that Forge's automatic security updates do not patch PHP, so Forge customers must update their servers themselves. Microsoft's App Service on Linux had fixed built-in images on two of its three release channels. Google Cloud's bulletin lists the fixed versions and says some workloads may be patched automatically while advising a redeploy; our security changes post https://www.digitalapplied.com/blog/website-security-after-php2shell-ai-era-2026 uses that three-answers-from-one-cloud pattern as the reason to put runtime patching in writing. The WordPress-specialist hosts were the mixed group. Automattic said its hosted WordPress service, VIP, WP Cloud and Pressable were already protected without naming a PHP version. WP Engine and Kinsta both had patching in progress, Kinsta with 8.5, 8.3 and 8.0 rolling out and 8.4, 8.2, 8.1 and 7.4 still in validation. SiteGround's post was last updated before the release and covered only mitigations. Acquia had disabled management services while waiting for an operating-system update from AWS, and AWS's own bulletin feed had no PHP item at 19:54 UTC. Hosts not in the table had published nothing we could find; absence here is a fact about our search, not about their servers. | Laravel's blog and Forge knowledge base, Automattic's blog, the WP Engine, Kinsta, Pantheon and Acquia status pages, SiteGround's blog, Google Cloud's security bulletins, the Azure App Service blog and AWS's bulletin feed, read October 21, 2026 at the UTC time shown. Hosts that had published nothing by then are not listed. | | | | |---|---|---|---| | Platform | Fixed build or package | Status | Read UTC | |---|---|---|---| | Laravel Cloud | Running apps patched in place to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 | Fixed | 20:37 | | Laravel Forge servers use Sury packages or a mirror of the PPA | Sury builds; Forge's automatic security updates do not patch PHP, so the customer must update; Laravel said at 20:35 UTC that all versions except 24.04 had patches. Changed since: its 20:49 UTC update tells 8.2 to 8.5 users to run Update PHP and says no patch is available for 8.0 or 8.1 re-read 21:54 UTC | Partly fixed, customer action required | 20:37 · 21:54 | | Laravel Vapor | Native runtimes updated for 8.2 to 8.5; a redeploy is needed; no patches for PHP 7. Changed since: the 20:49 UTC update says no patch is available for PHP 8.0 or 8.1 re-read 21:54 UTC | Fixed redeploy required | 20:37 · 21:54 | | Laravel Herd | None; no changelog entry | Not published | 20:40 | | Automattic · hosted WordPress service, WordPress VIP, WP Cloud, Pressable, Tumblr | No PHP version named; the post says sites are already protected with no action required | Protected per vendor no build named | 20:37 | | WP Engine | "Currently deploying patches to the platform"; no versions named | In progress | 20:39 | | Kinsta | 8.5, 8.3 and 8.0 rolling out; 8.4, 8.2, 8.1 and 7.4 still in validation. Changed since: at 21:17 UTC 7.4 joined the rollout; 8.4, 8.2 and 8.1 still in validation re-read 21:47 UTC | In progress | 20:37 · 21:47 | | Pantheon · PHP 8.2 to 8.5 | 8.5.12, 8.4.27, 8.3.36, 8.2.35 on all live production sites running supported versions | Fixed live production | 20:37 | | Pantheon · heirloom 8.1.x to 5.6.x | Via its LTS vendor once the patches are backported. Changed since: at 21:32 UTC Pantheon said it had received the LTS updates and was deploying them re-read 21:47 UTC | In progress re-read | 20:37 · 21:47 | | SiteGround | No fixed build named; the post, last updated 11:30 UTC, covers pre-release mitigations only | Not published fixed build | 20:38 | | Acquia Cloud Platform | Management services disabled while waiting for an operating-system update from AWS | Pending | 20:37 | | Google Cloud · App Engine Standard, Cloud Run, Cloud Run functions GCP-2026-070 | Lists 8.5.12, 8.4.27, 8.3.36, 8.2.35; some workloads patched automatically, redeploy advised; no per-runtime version | Partly fixed | 20:37 | | Microsoft Azure · App Service on Linux built-in PHP images | 8.2.35, 8.3.36, 8.4.27, 8.5.12 on the Latest and Standard release channels; the Extended channel receives the fix last | Fixed two of three channels | 20:37 | | AWS · security bulletins Elastic Beanstalk, Lightsail not named at first read | None; the bulletin feed had no PHP item at 19:54 UTC. Changed since: bulletin 2026-143-AWS at 21:30 UTC says Elastic Beanstalk PHP platform v4.13.12 shipped October 21, Lightsail blueprints were due October 21 and Amazon Linux packages are targeted for October 22 re-read 21:53 UTC | In progress re-read | 20:38 · 21:53 | 07 — End of LifePHP 8.1 and older: four routes to a fix, none from php.net . WordPress.org's PHP statistics, read October 21, put 36.4% of reporting installs on PHP 8.1 or older. For those sites the question is not which release to install but which vendor can supply a backport at all. The table above gives four answers. The grid below sorts them by who you would have to be to use each one. The sorting is ours; the facts are the vendors'. A distribution with extended support Fixed 7.4, 7.2, 7.0 and even 5.5 packages exist for Ubuntu Pro subscribers, and Red Hat and AlmaLinux ship a fixed php:7.4 module. TuxCare's extended-lifecycle builds were releasing through the evening. The version number stays old; the package revision moves. A third-party package repository Backported packages for every branch down to 5.6, published on release day with the upstream patch in the source. The php7.4 and php8.1 changelogs name both CVEs one entry below a snapshot note, so read past the top entry or compare the package string with the table. A control panel's own builds cPanel backported to ea-php74, 80 and 81; Plesk rebuilt 7.4.33, 8.0.30 and 8.1.34 with an October 21 build date; CloudLinux was rolling out alt-php by platform, though its 21:45 UTC correction said fixed alt-php was not yet in its CloudLinux 7 to 9 repositories. On a panel server, the panel's update is the fix. Build it yourself from the backport branch The PHP security team's branches carry one commit each and no release. This route exists for people who already compile PHP; it is not a path a typical site owner should start on this week. Several vendors said no outright. Amazon Linux lists AL2023's php8.1 and the AL2 core PHP as "No Fix Planned"; Microsoft says end-of-life PHP versions on App Service will not receive these patches; Google Cloud says its unsupported runtimes will not be patched; and Laravel's post, updated at 20:49 UTC, says no patch is available for PHP 8.0 or 8.1 on Forge or Vapor. For anyone on those, the fix is a migration, and the PHP 8.2 branch they would move to loses its own security support on December 31, 2026, so the sensible target is 8.3 or later. 08 — VerificationHow to check which build your site really runs. The command-line php binary, PHP-FPM, Apache's mod php and LiteSpeed can come from different packages, and a Sury, Plesk, cPanel or CloudLinux server routinely has several PHP versions installed side by side. So php -v reports the CLI binary on your path, which may not be the one serving your site. Check the package behind each site's handler, compare the full package string to the row in the tables above, and then restart every worker, because a running PHP-FPM pool, Apache process or queue worker keeps the old code in memory until it is restarted. The commands below are generic; the paths for panel-managed PHP are the ones each vendor documents. Debian / Ubuntu, including Ubuntu Pro and Sury dpkg -l 'php ' | awk '/^ii/ {print $2, $3}' apt-cache policy php8.4-fpm installed, candidate and source repo RHEL / AlmaLinux / Rocky / Fedora / Amazon Linux / SUSE rpm -q php php-cli php-fpm php8.4 on RHEL 10; php8 on SUSE rpm -q --changelog php | grep -E 'CVE-2026-10961 89 ' dnf module list php EL8/EL9: which php:X.Y stream is enabled Alpine apk info -v | grep '^php8' Build date Plesk's end-of-life fix is identified by an Oct 21 2026 build php -i | grep -E '^ PHP Version|Server API|Build Date ' Containers docker exec