Not php.net · Not NVD · Not CISA

PHP Vulnerability Tracker

Unofficial briefing on PHP security vulnerabilities

English简体中文日本語DeutschFrançaisNederlandsEspañol

Security alert

PHP2Shell: upgrade PHP. That is the only complete fix.

CVE-2026-109618 and CVE-2026-109619 are critical, unauthenticated remote-code-execution bugs in PHP itself. The PHP project shipped fixes on 21 October 2026 for the supported 8.2–8.5 branches. Restart PHP after you upgrade. A firewall is not a substitute.

Remediation steps

Is my PHP version still safe? · Supported

Is PHP 8.4 still safe?

The PHP project publishes support dates for every branch. PHP 8.4 is still covered, and 8.4.27 closes the October 2026 PHP2Shell bugs.

Last updated

Status at a glance

ItemValue
Initial release2024-11-21
Active support until2026-12-31
Security support until2028-12-31
PHP2Shell (CVE-2026-109618/109619)Vulnerable before 8.4.27; fixed in 8.4.27 (21 October 2026)

What to do

Stay on 8.4, but confirm php -v shows 8.4.27 or later on the SAPI that serves the site, then restart PHP-FPM or Apache. Distro packages may show an older upstream number with the fix backported; check the distro comparison.

PHP 8.4 · PHP2Shell

Other PHP branches

Is PHP 8.4 affected by PHP2Shell?

Yes, before 8.4.27. The PHP security team lists 8.4 before 8.4.27 as affected by both CVEs.

How long is PHP 8.4 supported?

php.net lists security support for 8.4 until 2028-12-31.

My distro shows an older 8.4 version. Am I vulnerable?

Not necessarily. Debian, Ubuntu and others backport fixes; compare the full package version with your distro’s tracker.

Sources

Outbound links leave this site. We do not host exploit code.

  1. Supported Versions — PHP project (php.net)
  2. Unsupported Branches — PHP project (php.net)
  3. News archive 2026: security advisory, 21 October 2026 — PHP project (php.net)
  4. CVE-2026-109618 — Ubuntu Security (Canonical)
  5. CVE-2026-109618 — Amazon Linux Security Center