Not php.net · Not NVD · Not CISA

PHP Vulnerability Tracker

Unofficial briefing on PHP security vulnerabilities

English简体中文日本語DeutschFrançaisNederlandsEspañol

Security alert

PHP2Shell: upgrade PHP. That is the only complete fix.

CVE-2026-109618 and CVE-2026-109619 are critical, unauthenticated remote-code-execution bugs in PHP itself. The PHP project shipped fixes on 21 October 2026 for the supported 8.2–8.5 branches. Restart PHP after you upgrade. A firewall is not a substitute.

Remediation steps

Is my PHP version still safe? · End of life

Is PHP 7.4 still safe?

PHP 7.4 is past its php.net end-of-life date, so the PHP project no longer ships releases for it, including for the October 2026 PHP2Shell bugs.

Last updated

Status at a glance

ItemValue
End of life (php.net)2022-11-28
Last php.net release7.4.33
PHP2Shell (CVE-2026-109618/109619)No official php.net release; minimal source backports only (see PHP 5 through 8.1)
Verified distro backportsUbuntu 20.04 (Ubuntu Pro) php7.4 7.4.3-4ubuntu2.29+esm5

What to do

Upgrade to 8.4 or 8.5. If you cannot yet, use a vendor that still patches 7.4 (a distro LTS or commercial support), keep the site off the public internet where possible, and see remediation for interim limits.

Other PHP branches

Is PHP 7.4 affected by PHP2Shell?

The PHP project published no official 7.4 release for these CVEs. Public write-ups disagree on how far back the bugs reach, so treat 7.4 as at risk.

When did PHP 7.4 reach end of life?

On 2022-11-28, according to php.net. The last official release was 7.4.33.

Can I keep running PHP 7.4?

Only if a vendor still ships security fixes for it and you install them. Otherwise upgrade.

Sources

Outbound links leave this site. We do not host exploit code.

  1. Supported Versions — PHP project (php.net)
  2. Unsupported Branches — PHP project (php.net)
  3. News archive 2026: security advisory, 21 October 2026 — PHP project (php.net)
  4. CVE-2026-109618 — Ubuntu Security (Canonical)
  5. CVE-2026-109618 — Amazon Linux Security Center