Linux distributions

PHP2Shell fixed packages by Linux distribution

Distributions backport the fix into their own PHP packages, so the version number often stays old. Find the first fixed build for your release below, then verify the package that actually serves your site.

Last reviewed 2026-10-23

An old version number can be patched

Ubuntu 24.04 still reports PHP 8.3.6 after the fix; Debian, RHEL, AlmaLinux and SUSE work the same way. Compare the full package revision with the vendor advisory. php -v alone cannot tell you.

Verified vendor package versions

First fixed builds for the listed releases and source packages, covering both CVEs. These are vendor revisions, so an older upstream number can be patched. Check your exact release, official channel and installed build, then restart every web worker. Reviewed 2026-10-22.

Operating systemPHP packageFirst fixed vendor buildUpdate channelEvidence
SLE 15 SP7 · Web and Scripting Modulephp88.3.36-150700.3.24.1SUSE subscription / enabled moduleSUSE-SU-2026:4844-1
Ubuntu 26.10php8.58.5.9-0ubuntu2.1Security updatesUSN-8948-1
Ubuntu 26.04 LTSphp8.58.5.4-0ubuntu1.5Security updatesUSN-8948-1
Ubuntu 24.04 LTSphp8.38.3.6-0ubuntu0.24.04.13Security updatesUSN-8948-1
Ubuntu 22.04 LTSphp8.18.1.2-1ubuntu2.28Security updatesUSN-8948-1
Ubuntu 20.04 LTSphp7.47.4.3-4ubuntu2.29+esm5Ubuntu Pro / ESMUSN-8948-2
Ubuntu 18.04 LTSphp7.27.2.24-0ubuntu0.18.04.17+esm14Ubuntu Pro / ESMUSN-8948-2
Ubuntu 16.04 LTSphp7.07.0.33-0ubuntu0.16.04.16+esm22Ubuntu Pro + Legacy SupportUSN-8948-2
Ubuntu 14.04 LTSphp55.5.9+dfsg-1ubuntu4.29+esm18Ubuntu Pro + Legacy SupportUSN-8948-2
Debian 13 (trixie)php8.48.4.27-1~deb13u1Security updatesDSA-6574-1
Debian 12 (bookworm)php8.28.2.35-1~deb12u1Debian LTS / securityDLA-4848-1
RHEL 8 · php:7.4php7.4.33-8.module+el8.10.0+25117+30337ccaRed Hat AppStreamRHSA-2026:87080
AlmaLinux 10 · php 8.3 (default)php8.3.33-1.el10_2.alma.1AlmaLinux AppStreamAlmaLinux blog
AlmaLinux 10 · php8.4php8.48.4.24-1.el10_2.alma.1AlmaLinux AppStreamAlmaLinux blog
AlmaLinux 9 · php 8.0 (default)php8.0.30-8.el9_8.alma.1AlmaLinux AppStreamAlmaLinux blog
AlmaLinux 9 · php:8.3php8.3.33-1.module_el9.8.0+328+1fdeb728.alma.1AlmaLinux AppStreamAlmaLinux blog
AlmaLinux 9 · php:8.2php8.2.33-1.module_el9.8.0+327+37dfd4b4.alma.1AlmaLinux AppStreamAlmaLinux blog
AlmaLinux 9 · php:8.1php8.1.32-1.module_el9.8.0+326+528679fc.alma.1AlmaLinux, retired streamAlmaLinux blog
AlmaLinux 8 · php:8.2php8.2.33-1.module_el8.10.0+4320+c30d6dbb.alma.1AlmaLinux AppStreamAlmaLinux blog
AlmaLinux 8 · php:8.0php8.0.30-1.module_el8.10.0+4319+26f10322.alma.1AlmaLinux, retired streamAlmaLinux blog
AlmaLinux 8 · php:7.4php7.4.33-8.module_el8.10.0+4321+cf5fd4bbAlmaLinux AppStreamAlmaLinux blog
AlmaLinux 8 · php:7.3php7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1AlmaLinux, retired streamAlmaLinux blog
AlmaLinux 8 · php:7.2php7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1AlmaLinux, retired streamAlmaLinux blog

This snapshot does not establish the status of other repositories, Ubuntu PPAs, Debian sid/forky or every third-party image. Later builds in the same official update channel may include these fixes; confirm the vendor advisory. The version checker conservatively asks you to verify vendor packages. AlmaLinux and RHEL rows apply to the named module stream; install that build or higher. Future fixes for retired streams are not guaranteed. Red Hat has additional advisories covering both CVEs, including RHSA-2026:87079 for RHEL 9 php:8.3. This table is a verified subset, not the complete Red Hat release list; check the advisory for your product and stream. The SUSE row covers only the Web and Scripting Module 15-SP7 (aarch64, ppc64le, s390x, x86_64). SUSE modules require the appropriate registered product and enabled repositories; they are included in the SLES subscription. Apply the advisory through YaST Online Update or zypper patch, then restart the actual PHP-FPM/Apache workers. A released PHP8 package does not establish that PHP7, SLE 16 or an SP6 installation without its required support channel is fixed.

Check the installed build

Compare the output with the table: the installed revision must be equal to or newer than the listed build in the same release and channel. Then restart every PHP worker.

shell
# Debian / Ubuntu: installed PHP package revisions
dpkg-query -W -f='${binary:Package} ${Version}\n' 'php*-common' 'libapache2-mod-php*' 2>/dev/null

# RHEL / AlmaLinux / Rocky: installed build and module stream
rpm -q php-common php-fpm
dnf module list --enabled php 2>/dev/null

# SUSE: installed build and pending security patches
rpm -q php8 php8-fpm
zypper list-patches --cve=CVE-2026-109618

# Then restart the workers and confirm they started after the upgrade
ps -eo pid,lstart,cmd | grep -E '[p]hp-fpm|[a]pache2|[h]ttpd'

Not in the table?

  • A missing row means we have not verified that release yet, not that it is safe or unfixed. Check your vendor’s tracker: Ubuntu, Debian, Red Hat, SUSE.
  • Third-party repositories (Ondřej Surý’s PPA / packages.sury.org, Remi, CloudLinux alt-php, panel builds) are separate channels with their own fixed builds. See the patch guide and the aaPanel / 1Panel page.
  • Containers do not inherit host updates. Rebuild images on a fixed base and redeploy.
  • On PHP 8.1 or older without a vendor package, read the end-of-life section.

Questions

Why does php -v still show an old version after the update?+

Distributions backport security fixes without changing the upstream version. On Ubuntu 24.04 the fixed package is 8.3.6-0ubuntu0.24.04.13, so php -v still says 8.3.6. Check the package revision with dpkg-query or rpm -q and compare it with the vendor advisory.

Do I need to restart anything after upgrading the package?+

Yes. Running PHP-FPM, Apache (mod_php) and long-running PHP workers keep the old code in memory until they restart. Restart them after the upgrade and confirm the process start times.

Is Ubuntu 20.04 or 18.04 fixed?+

Yes, through Ubuntu Pro / ESM (USN-8948-2). Without Pro enabled, the fixed package is not available from the standard archive. 16.04 and 14.04 need Legacy Support.

What is Red Hat RHSB-2026-013?+

RHSB-2026-013 is Red Hat’s security bulletin for PHP2Shell. It covers RHEL 10, 9 and 8 and OpenShift Dev Spaces 3, and says products and containers built on RHEL or UBI may be affected: rebuild containers when the base images update. Fixes are published per module stream, for example RHSA-2026:87079 (RHEL 9 php:8.3) and RHSA-2026:87080 (RHEL 8 php:7.4).

Related