Am I affected?Check, then fix.
Pick your software. See the official fixed versions, then check yours.
PHP2Shell
If your PHP is a build from the project itself and is older than the fixed release for its branch, update it.
Installed with apt, dnf or apk? Use the Linux packages and images table below.
Two critical PHP flaws can allow unauthenticated remote code execution.
Fixed releases by branchUpstream releases only. Packaged builds are in the table below.
| Branch | − Affected | + Fixed in |
|---|---|---|
| 8.5 | −below 8.5.12 | +8.5.12 |
| 8.4 | −below 8.4.27 | +8.4.27 |
| 8.3 | −below 8.3.36 | +8.3.36 |
| 8.2 | −below 8.2.35 | +8.2.35 |
Linux packages and imagesVersion strings as the vendor prints them
| Release | Package and fixed version | Status |
|---|---|---|
| 26.10 (stonking) | php8.5 → 8.5.9-0ubuntu2.1 | Fixed |
| 26.04 LTS (resolute) | php8.5 → 8.5.4-0ubuntu1.5 | Fixed |
| 24.04 LTS (noble) | php8.3 → 8.3.6-0ubuntu0.24.04.13 | Fixed |
| 22.04 LTS (jammy) | php8.1 → 8.1.2-1ubuntu2.28 | Fixed |
| 20.04 LTS (focal) | php7.4 → 7.4.3-4ubuntu2.29+esm5 | Fixed |
| 18.04 LTS (bionic) | php7.2 → 7.2.24-0ubuntu0.18.04.17+esm14 | Fixed |
| 16.04 LTS (xenial) | php7.0 → 7.0.33-0ubuntu0.16.04.16+esm22 | Fixed |
67 of 84 tracked Linux packages and images have the fix. 17 end-of-life releases have no vendor fix and are not counted.
Is your PHP affected? Full details →Check your PHP version against PHP2Shell
Pick what you have. We compare it with the official fixed versions.
Runs in your browser. Nothing is sent.
Runs in your browser. Nothing is sent.
Runs in your browser. Nothing is sent.
We search the open events we track. If it is not there, we say so.
Where the fix has arrived for PHP, and where it has not
Counts come from the tracked records. Unknown is never counted as fixed.| Component | State | Detail |
|---|---|---|
| Supported branchesOfficial releases | Fixed | 4 of 4 branches have an official fixed release. |
| End-of-life branches8.1, 8.0, 7.4 | Needs attention | No official release. The project published a source patch only, so distributors may ship their own backport. |
| Older branchesBranches older than 7.4 | Needs attention | No official fix. Update to a supported branch. |
| Linux packages and imagesUbuntu, Debian, RHEL family, Alpine, Docker images | Partly fixed | 67 of 84 fixed. 3 have no fix yet and 14 are unconfirmed. 17 end-of-life releases are not counted and have no vendor fix. |
| Hosting providersStatements by each provider | Partly fixed | 34 of 76 report the fix applied. 13 are rolling out or planned, 22 ask customers to act or give a workaround, 7 have no statement or are unconfirmed. |
Also hot now
Status board →-
Node2Shell
Fixed upstream in 3 release lines: v26.12.1, v24.22.1, v22.23.4
SeverityHighNode.js
See what to do → -
CVE-2021-45046
Fixed upstream in 3 release lines: 2.16.0, 2.12.3, 2.3.1
SeverityCritical9.0CVSS v3.1Apache Logging Services
See what to do → -
CVE-2021-44228
Fixed upstream in 3 release lines: 2.15.0, 2.12.2, 2.3.1
SeverityCritical10.0CVSS v3.1Apache Logging Services
See what to do → -
CVE-2025-24813
Fixed upstream in 3 release lines: 11.0.3, 10.1.35, 9.0.99
SeverityHigh8.6CVSS v3.1Red Hat
See what to do →
Recently updated
- PHPAdded a section for ppa:ondrej/php (Ubuntu) and packages.sury.org (Debian) users: which package version is the fixed one, how to read the Installed line of apt policy, how to update, and which checker tab to use. It is in the Ubuntu and Debian guide, in the guide to PHP 7.4, 8.0 and 8.1 (end-of-life) and on the fixed-versions page. The versions shown are the ones already recorded from each repository's own changelog.
- PHPHome page: added a short section on the CISA due date for the two PHP CVEs (29 Oct 2026), on checking for signs of compromise after patching (guidance from NCSC New Zealand, the Canadian Centre for Cyber Security and CISA), and on the Linux kernel vulnerability CVE-2026-46300, which CISA added to its KEV catalog on 28 Oct 2026 and whose entry says it can be chained with both PHP CVEs.Vendor announcementsource ↗
- PHPThe alert bar, the urgency line in the checker result and the status page now cite CISA's Known Exploited Vulnerabilities listing of 26 Oct 2026 instead of AWS's report of exploitation attempts.Vendor announcementsource ↗
- PHPCISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog (catalog version 2026.10.26); the entry lists 29 Oct 2026 as the due date for US federal agencies.Vendor announcementsource ↗
- PHPThe official Windows PHP builds for 8.5, 8.4, 8.3 and 8.2 were rebuilt with updated dependencies (Brotli security fix) and now carry a -1 suffix (8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1). php.net says the PHP runtime versions are unchanged, so the fixed versions stay 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The Windows rows now cite the current releases.json on downloads.php.net.
- Open events
- 33
- Packages and images fixed
- 67of 84
- Waiting for a fix
- 3
- Unconfirmed
- 14
Counts cover the Linux packages and images tracked for PHP: 67 fixed + 3 waiting + 14 unconfirmed = 84 tracked. 17 end-of-life releases have no vendor fix and are not counted. Hosting providers are counted separately.
How to read a status
Each status has a shape, a word and a border style. Colour is never the only signal.
Fixed
The record you are reading lists a fix, or the vendor says the release was never affected (“Not affected”, tagged “Vendor statement”). The scope is always named: this release, this package, this host.
Next: confirm you run that version or later.
Not fixed
Only for a value you pasted: it is below the fixed release for its branch.
Next: update, then check again.
Needs attention
No fix you can simply install, or one that depends on someone else: an end-of-life branch, a vendor still working, a workaround only.
Next: wait for the vendor, or apply the workaround.
Unconfirmed
We could not confirm it from an official source, or only one official source says so. Unknown is never shown as fixed.
Next: check the vendor's own page.
Why a lower number can be fixed
26.10 (stonking) ships php8.5 8.5.9-0ubuntu2.1. That number is lower than the upstream fixes listed above, yet 26.10 (stonking) marks it fixed, because the vendor backported the patch to its own version. Compare a package number only with the vendor's own row, never with an upstream number.
| Release | Package and fixed version | Status |
|---|---|---|
| 26.10 (stonking) | php8.5 → 8.5.9-0ubuntu2.1 | Fixed |
| 26.04 LTS (resolute) | php8.5 → 8.5.4-0ubuntu1.5 | Fixed |
| 24.04 LTS (noble) | php8.3 → 8.3.6-0ubuntu0.24.04.13 | Fixed |
A vendor row says one of three things. Fixed names the package version. No fix yet means the vendor lists the flaw but names no package. Unconfirmed means we found no official statement.
Email alerts open soon
Sign-up is not open yet. Until it is, the status board lists every open event with the time it was last checked.
Open the status boardWritten patch plan, US$49
Send us your server details. A written step-by-step plan reaches you by email within 24 hours. We never log in to your server.
See the planHow PatchBell works
Read the method →Official sources only
Every version comes from the project or vendor that ships it. A version is shown as fixed when two independent official sources agree, or when the project's own advisory or release notes say so. With a single source from anyone else we still show it, marked Unconfirmed. Distro rows come from that distro's own tracker.
Last checked, on every page
Each page shows when its data was last read. Old information is never dressed up as new.
A reference, not a scanner
Checks run in your browser against data bundled with the page. Nothing is sent, and your site is never contacted.