PHP 8.5
Is PHP 8.5 vulnerable to PHP2Shell?
The PHP security team names PHP 8.5 before 8.5.12 in the affected list for both CVEs. PHP 8.5.12 is the first upstream release in this branch that closes them. A version string at or above 8.5.12 is the comparison the project published; it does not prove the web server has been restarted onto that binary.
Last updated
| Fact | What the source says | Source |
|---|---|---|
| Affected range | PHP 8.5 before 8.5.12 | oss-security |
| Upstream fix | 8.5.12 on 21 October 2026, or a later 8.5 release | php.net |
| Both CVEs | One release closes CVE-2026-109618 and CVE-2026-109619. There is no second patch number. | php.net |
| Severity | CVSS v4.0 9.2 for each CVE, as stated by the PHP security team | oss-security |
| Where it applies | Installations that serve web requests. Apache mod_php is the highest risk named by PHP. PHP-FPM is also in scope. | php.net |
| What to do | Upgrade to 8.5.12 or later and restart the workers. CISA says to patch immediately. A firewall is not the complete fix. | CISA; php.net |
How to read a version string
Compare the major.minor.patch triplet with 8.5.12. Anything in the 8.5 branch below that triplet is the range the security team listed. The version checker does that comparison in the browser and does not see whether a distribution kept an older number and shipped a backport under a package suffix. On this supported branch the upstream fix is itself a version bump, so a triplet below 8.5.12 is not the php.net fix.
After the package is installed, check the SAPI that answers HTTP, not only `php -v` on an admin shell. Restart php-fpm or Apache so the new binary is the one serving traffic. Steps for apt, dnf, Docker, cPanel, and Plesk are on the remediation page. 宝塔面板 has a separate click path on the BT Panel page.
Other branches
- PHP 8.4Vulnerable before 8.4.27. That release is the upstream fix for both CVEs.
- PHP 8.3Vulnerable before 8.3.36. That release is the upstream fix for both CVEs.
- PHP 8.2Vulnerable before 8.2.35. That release is the upstream fix for both CVEs.
- PHP 5 through 8.1No official fix release. Source backports exist only for 7.4, 8.0, and 8.1.
- 宝塔面板 (BT Panel)The panel’s 22 October notice says where its own package numbers differ from php.net.
Is PHP 8.5 vulnerable?
Yes, before 8.5.12. Jakub Zelenka’s oss-security note lists PHP 8.5 below 8.5.12 among the affected versions for CVE-2026-109618, in the same release window as CVE-2026-109619. The php.net advisory treats the pair together.
Which PHP 8.5 version fixes it?
PHP 8.5.12, released on 21 October 2026, or a later release in the 8.5 branch. That is the upstream fix for both CVE-2026-109618 and CVE-2026-109619. Install it, then restart Apache, PHP-FPM, or whichever SAPI serves the site.
Does 8.5.12 fix both CVEs?
The PHP project published one set of releases for both bugs. There is no separate 8.5 patch for CVE-2026-109618 and another for CVE-2026-109619.
Is a firewall or a php.ini change enough?
No. The PHP project says updating is the only complete fix. Interim settings reduce specific paths and are copied on the remediation page. They are not a substitute for PHP 8.5.12.
Sources
Outbound links leave this site. We do not host exploit code.
- News archive 2026: security advisory, 21 October 2026 — PHP project (php.net)
- CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption — oss-security (Jakub Zelenka, PHP security team)
- Today’s PHP security release, and how we’re strengthening PHP security — The PHP Foundation
- Critical vulnerabilities in PHP require immediate patching (21 October 2026) — CISA
- GHSA-w8hw-w9fx-j79w — CVE-2026-109618 — PHP (GitHub Security Advisory)
- GHSA-6wmf-4rv5-p3rp — CVE-2026-109619 — PHP (GitHub Security Advisory)