Which PHP versions are affected by PHP2Shell?

One branch at a time

• PHP 8.5Yes, before 8.5.12. That version is the upstream fix.
• PHP 8.4Yes, before 8.4.27. That version is the upstream fix.
• PHP 8.3Yes, before 8.3.36. That version is the upstream fix.
• PHP 8.2Yes, before 8.2.35. That version is the upstream fix.
• PHP 5 through 8.1No official release. The write-ups do not share one lower bound.
• 宝塔面板Panel packages for Linux 7.4, 8.0, and 8.1 are not php.net releases.

Why the table has a gap under 8.2

Jakub Zelenka’s oss-security message names the affected versions as the four supported branches before those patch levels. That sentence is about the versions the security team was patching with releases. It is not, by itself, a claim that 8.1 is unaffected. The php.net advisory says 8.1 and older no longer receive updates from the PHP project, points operators at distribution and LTS backports, and says the security team provided minimal source backports for 7.4, 8.0, and 8.1 for people building from source. Publishing a backport is evidence those three branches were in scope. It is not a supported release you can apt-install from php.net.

Wiz says the issues go back to PHP 5.4 and that nearly every version from the past decade is affected by at least one of them. Google Cloud writes “all versions of PHP from 5.4 through 8.5.11.” Cloudflare writes “PHP 5.4 or later.” ThreatCluster notes that session.upload_progress has existed since PHP 5.4.0 and is enabled by default; that feature is one path named for CVE-2026-109619, not a proof that every code path stops at 5.4. watchTowr wrote, on 20 October, that the bugs affect PHP 5, 7, and 8 in their entirety. Expel’s later notice is the cautious correction: early “all of PHP 5” claims ran ahead of the vendor text, 7.3 and older were not explicitly confirmed by PHP in the material Expel reviewed, and end-of-life PHP on the web should be assumed at risk anyway.

The checker is a version-number comparison

It runs entirely in your browser. It does not send the version anywhere. It can tell you whether a triplet is at least 8.2.35, 8.3.36, 8.4.27, or 8.5.12. It cannot tell you whether Ubuntu, RHEL, cPanel, or a container vendor has backported the fix onto an older number. It cannot see which binary your web server actually loaded. After you upgrade, compare php-fpm -v or the Apache module’s build, restart the service, and check again.