Not php.net · Not NVD · Not CISA

PHP Vulnerability Tracker

Unofficial briefing on PHP security vulnerabilities

English简体中文日本語DeutschFrançaisNederlandsEspañol

Security alert

PHP2Shell: upgrade PHP. That is the only complete fix.

CVE-2026-109618 and CVE-2026-109619 are critical, unauthenticated remote-code-execution bugs in PHP itself. The PHP project shipped fixes on 21 October 2026 for the supported 8.2–8.5 branches. Restart PHP after you upgrade. A firewall is not a substitute.

Remediation steps

PHP version safety · from php.net supported versions

Is my PHP version still safe?

A PHP branch is safe to run only while php.net (or a vendor you pay or trust) still ships security fixes for it, and only if you have installed them. Pick your branch for dates, PHP2Shell status and upgrade advice.

Last updated

php.net
Branchphp.net statusSecurity support untilPHP2Shell fixed in
PHP 8.5Active support2029-12-318.5.12
PHP 8.4Active support2028-12-318.4.27
PHP 8.3Security fixes only2027-12-318.3.36
PHP 8.2Security fixes only (ends soon)2026-12-318.2.35
PHP 8.1End of life2025-12-31—
PHP 8.0End of life2023-11-26—
PHP 7.4End of life2022-11-28—

Which PHP version should I use in 2026?

PHP 8.4 or 8.5. Both have active support from php.net, 8.4 until 31 December 2026 and 8.5 until 31 December 2027, followed by two years of security fixes.

Is PHP 7.4 still safe?

No. It reached end of life on 28 November 2022, and only paid or distro extended support still patches it.

Sources

Outbound links leave this site. We do not host exploit code.

  1. Supported Versions — PHP project (php.net)
  2. Unsupported Branches — PHP project (php.net)
  3. News archive 2026: security advisory, 21 October 2026 — PHP project (php.net)
  4. CVE-2026-109618 — Ubuntu Security (Canonical)
  5. CVE-2026-109618 — Amazon Linux Security Center