Not php.net · Not NVD · Not CISA

PHP Vulnerability Tracker

Unofficial briefing on PHP security vulnerabilities

English简体中文日本語DeutschFrançaisNederlandsEspañol

Security alert

PHP2Shell: upgrade PHP. That is the only complete fix.

CVE-2026-109618 and CVE-2026-109619 are critical, unauthenticated remote-code-execution bugs in PHP itself. The PHP project shipped fixes on 21 October 2026 for the supported 8.2–8.5 branches. Restart PHP after you upgrade. A firewall is not a substitute.

Remediation steps

Is my PHP version still safe? · Security fixes only

Is PHP 8.3 still safe?

The PHP project publishes support dates for every branch. PHP 8.3 is still covered, and 8.3.36 closes the October 2026 PHP2Shell bugs.

Last updated

Status at a glance

ItemValue
Initial release2023-11-23
Active support until2025-12-31
Security support until2027-12-31
PHP2Shell (CVE-2026-109618/109619)Vulnerable before 8.3.36; fixed in 8.3.36 (21 October 2026)

What to do

Make sure you run 8.3.36 or later now. 8.3 only receives critical security fixes, so schedule the upgrade to 8.4 or 8.5 using php.net’s migration guides before 2027-12-31.

PHP 8.3 · PHP2Shell

Other PHP branches

Is PHP 8.3 affected by PHP2Shell?

Yes, before 8.3.36. The PHP security team lists 8.3 before 8.3.36 as affected by both CVEs.

How long is PHP 8.3 supported?

php.net lists security support for 8.3 until 2027-12-31.

My distro shows an older 8.3 version. Am I vulnerable?

Not necessarily. Debian, Ubuntu and others backport fixes; compare the full package version with your distro’s tracker.

Sources

Outbound links leave this site. We do not host exploit code.

  1. Supported Versions — PHP project (php.net)
  2. Unsupported Branches — PHP project (php.net)
  3. News archive 2026: security advisory, 21 October 2026 — PHP project (php.net)
  4. CVE-2026-109618 — Ubuntu Security (Canonical)
  5. CVE-2026-109618 — Amazon Linux Security Center