PHP2Shell fixes compared across Linux distributions

Fixed package versions by distribution

How to read this table

• A distro version like 8.3.6-0ubuntu0.24.04.13 can be fixed even though 8.3.6 is far below php.net’s 8.3.36. Ubuntu and Debian backport the patches; version scanners that only compare upstream numbers will report a false positive.
• Red Hat, SUSE and Amazon rate both CVEs Important with CVSS v3 8.1 (attack complexity High). NVD lists 9.8. Red Hat notes that default RHEL uses PHP-FPM rather than mod_php, which makes exploitation harder in practice, but still ships fixes.
• Ubuntu 16.04 to 20.04 and 14.04 get fixes only through Ubuntu Pro. Without Pro those releases stay vulnerable.
• Third-party repositories (Ondřej Surý’s PPA and DEB.SURY.ORG, Remi, IUS, panel builds) are separate packages. Check them on their own pages under affected products.

Not yet fixed in a supported channel

• RHEL 8, 9 and 10: Red Hat says some updates are available and others are in progress. Follow RHSB-2026-013 and run dnf updateinfo list --security.
• SLES 15 SP4 to SP6, openSUSE Leap and SUSE BCI php images were still marked affected; SLES 16.0 has packages in QA.
• Amazon Linux 2023 php8.1 and Amazon Linux 2 core php are marked no fix planned. Move to php8.2 or newer.
• Debian forky (testing) had 8.4.26-1 when checked; the fix is in sid as 8.4.27-1.

Check which package you have

These read-only commands print the installed version. Compare it with the fixed version above for your exact release.

# Debian / Ubuntu: installed PHP package versions
dpkg -l 'php*' | awk '/^ii/ {print $2, $3}'
# Debian / Ubuntu: changelog mentions the CVE?
apt changelog php8.2 2>/dev/null | grep -m3 -E 'CVE-2026-10961(8|9)'

# RHEL family / SUSE / Amazon Linux
rpm -qa 'php*' | sort
rpm -q --changelog php-common 2>/dev/null | grep -m3 -E 'CVE-2026-10961(8|9)'

# Alpine
apk info -v | grep '^php'

# Then restart what serves PHP (examples)
systemctl restart php8.2-fpm   # or php-fpm, apache2, httpd