Products and stacks
Is my site affected? Products that bundle PHP
Many sites never install PHP directly: it arrives inside a local stack, a hosting panel, a container image, a NAS or an appliance. Updating the application does not fix PHP2Shell (CVE-2026-109618, CVE-2026-109619); the PHP underneath must be one of 8.2.35, 8.3.36, 8.4.27, 8.5.12 or a vendor build with the backported fix. Find your product below.
Last updated
Vendor fix available
21
Partly fixed
11
Affected, no fix yet
6
Patch your OS / host PHP
21
No vendor advisory
10
Status
Category
Local stacks and app servers
| Product | Status | PHP shipped / used |
|---|---|---|
| XAMPP | No vendor advisory | 8.0.30 – 8.2.12 |
| WampServer | Vendor fix available | 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 (add-ons) |
| MAMP and MAMP PRO | No vendor advisory | 8.3.28 · 8.4.15 · 8.5.0 |
| Laragon | No vendor advisory | 8.3.33 |
| Laravel Herd | Vendor fix available | 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 |
| ServBay | Partly fixed | v1 fixed · v2 8.2.30 / 8.3.30 / 8.4.18 / 8.5.3 |
| FrankenPHP and Laravel Octane | Vendor fix available | FrankenPHP 1.13.2 |
| NativePHP and static-php-cli | No vendor advisory | 8.3.31 · 8.4.21 · 8.5.6 |
Hosting control panels
| Product | Status | PHP shipped / used |
|---|---|---|
| cPanel & WHM (EasyApache 4 ea-php) | Vendor fix available | ea-php74 – ea-php85 |
| Plesk Obsidian | Vendor fix available | 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 · 7.4/8.0/8.1 rebuilt |
| DirectAdmin (CustomBuild) | Vendor fix available | CustomBuild 8.2–8.5 · patched older branches |
| CloudLinux alt-php and PHP Selector | Partly fixed | alt-php52 – alt-php85 · ea-php52 – ea-php85 |
| CyberPanel | Vendor fix available | lsphp 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 |
| LiteSpeed and OpenLiteSpeed (lsphp) | Vendor fix available | lsphp 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 |
| aaPanel | Partly fixed | App Store PHP 8.2–8.5 fixed |
| 宝塔面板 (BT Panel) | Partly fixed | 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 · BT 7.4.34/8.0.31/8.1.35 |
| HestiaCP | Partly fixed | sites: Sury packages · panel: hestia-php 8.5.9 |
| CloudPanel | Partly fixed | 8.2–8.5 fixed · 8.1 and older not fixed |
| ISPConfig 3 | Patch your OS / host PHP | OS or Sury packages |
| Virtualmin and Webmin | Patch your OS / host PHP | OS packages |
| Control Web Panel (CWP) | No vendor advisory | panel-built PHP |
| Webuzo | Vendor fix available | EMPS (bundled) |
| Coolify | Vendor fix available | 8.4.27 |
Hosting platforms and server managers
| Product | Status | PHP shipped / used |
|---|---|---|
| Laravel Forge | Patch your OS / host PHP | Forge PHP repository |
| RunCloud | No vendor advisory | RunCloud PHP packages |
| ServerPilot | No vendor advisory | ServerPilot PHP packages |
| AWS: Amazon Linux, Elastic Beanstalk, Lightsail | Partly fixed | AL2023 php8.2–8.5 · AL2 php |
| Azure App Service (PHP) | Partly fixed | Linux built-in 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 |
Linux distributions, repositories and Windows
| Product | Status | PHP shipped / used |
|---|---|---|
| Ubuntu | Vendor fix available | 22.04 php8.1 · 24.04 php8.3 · 26.04 php8.5 |
| Ondřej Surý PPA and packages.sury.org | Vendor fix available | 5.6 – 8.5 |
| Debian | Vendor fix available | 12: 8.2.35 · 13: 8.4.27 |
| RHEL, AlmaLinux and Rocky Linux | Partly fixed | RHEL 8: 7.4/8.2 · RHEL 9: 8.0/8.2/8.3 · RHEL 10: 8.3/8.4 |
| Remi's RPM repository | Vendor fix available | 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 |
| Alpine Linux | Partly fixed | 3.24 and edge: 8.3.36 · 8.4.27 · 8.5.12 |
| PHP on Windows and IIS | Vendor fix available | 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 |
Container images
| Product | Status | PHP shipped / used |
|---|---|---|
| Docker official php images | Vendor fix available | 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 |
| Bitnami PHP images | Partly fixed | php-fpm 8.5.12 · bitnamilegacy 8.4.11 |
NAS devices
| Product | Status | PHP shipped / used |
|---|---|---|
| Synology DSM and Web Station | No vendor advisory | Web Station 8.2.30 · 8.3.30 · 8.4.19 |
| QNAP QTS and QuTS hero Web Server | No vendor advisory | bundled |
| Unraid OS | No vendor advisory | 8.4.26 (Unraid 7.3.3) |
| openmediavault | Patch your OS / host PHP | Debian packages |
Firewalls, appliances and IT tools
| Product | Status | PHP shipped / used |
|---|---|---|
| pfSense (Netgate) | Vendor fix available | 8.5.12 (Plus 26.07, 26.03.1, CE 2.9.0) · 8.3.36 (CE 2.8.1) |
| OPNsense | Vendor fix available | 8.5.12 (26.7.7) · 8.3.36 (BE 26.4.2p3) |
| FreePBX and PBXact | Affected, no fix yet | 17: Debian 12 PHP 8.2 · 16: PHP 7.4 |
| Nagios XI | Patch your OS / host PHP | OS packages |
| Zabbix frontend | Patch your OS / host PHP | OS packages · Docker web images: Alpine PHP 8.5 |
| GLPI | Vendor fix available | Docker 8.5.12 · packages: host PHP |
| Palo Alto Networks PAN-OS and Panorama | Affected, no fix yet | bundled |
| Fortinet products (FortiADC, FortiDDoS, FortiSIEM, FortiSOAR) | Affected, no fix yet | bundled (under investigation) |
| F5 BIG-IP Configuration utility | Affected, no fix yet | bundled |
| Citrix NetScaler ADC and Gateway | Affected, no fix yet | bundled |
| Trend Micro Apex One and Apex Central | Affected, no fix yet | 8.2.30 / 8.2.33 |
| mailcow | Vendor fix available | 8.2.35 |
CMS and web applications
| Product | Status | PHP shipped / used |
|---|---|---|
| Nextcloud | Vendor fix available | AIO 8.4.27 · server: host PHP |
| WordPress | Patch your OS / host PHP | host PHP |
| Magento and Adobe Commerce | Patch your OS / host PHP | host PHP |
| Drupal (including Drupal 7) | Patch your OS / host PHP | host PHP |
| Joomla (including Joomla 3) | Patch your OS / host PHP | host PHP |
| PrestaShop | Patch your OS / host PHP | host PHP |
| OpenCart | Patch your OS / host PHP | host PHP |
| phpBB | Patch your OS / host PHP | host PHP |
| vBulletin | Patch your OS / host PHP | host PHP |
| Moodle | Patch your OS / host PHP | host PHP |
| SuiteCRM | Patch your OS / host PHP | host PHP |
| vtiger CRM | Patch your OS / host PHP | host PHP |
| OpenEMR | Patch your OS / host PHP | host PHP |
| Dolibarr ERP & CRM | Patch your OS / host PHP | host PHP |
| phpMyAdmin | Patch your OS / host PHP | host PHP |
| MediaWiki | Patch your OS / host PHP | host PHP |
See also: Remediation by platform · Affected versions · Vendor status
Unofficial summary of public sources. This site is not affiliated with the vendor or the PHP project and hosts no exploit code.