End of life

Is PHP 5 through 8.1 vulnerable, and which version fixes it?

There is no official PHP release that fixes these two CVEs on PHP 8.1 or older. The PHP project published minimal source backports for 7.4, 8.0, and 8.1 only. Below that, the cited write-ups do not use one range, so this page keeps the disagreement instead of flattening it.

Last updated 2026-10-22

The cells disagree on purpose. Read the source column before you treat a row as the range.

Claim	What that source says	Source
Branches PHP patched with a release	8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, 8.5 before 8.5.12	oss-security
PHP 8.1 and older	No longer updated by the PHP project. Minimal source backports for 7.4, 8.0, and 8.1 only, for people building from source.	php.net
Lower bound used by Google Cloud	All versions from PHP 5.4 through 8.5.11	Google Cloud
Lower bound used by Cloudflare	PHP 5.4 or later	Cloudflare
Wiz	The issues go back to PHP 5.4, and nearly every version from the past decade is affected by at least one of them	Wiz
watchTowr, 20 October FAQ	PHP 5, 7, and 8 in their entirety. This was written before the finished advisory.	watchTowr FAQ
Expel’s correction	Backports show 7.4, 8.0, and 8.1 affected. PHP has not explicitly confirmed 7.3 and older in the material Expel reviewed.	Expel
If you cannot update	Take the system offline, explicitly including PHP 8.1 and earlier	CISA
Not a PHP release	宝塔’s Linux packages 7.4.34, 8.0.31, and 8.1.35 are panel builds. The notice says they include both fixes. Windows does not get those three packages.	宝塔 notice

What “fixed” can mean on these branches

A version number such as 8.1.34 or 7.4.33 does not tell you whether a distribution backport is installed. The checker will call these lines end of life for that reason. cPanel and Plesk have published their own build identifiers on the vendor page. 宝塔’s numbers are only on the BT Panel page, and only the Linux packages are claimed there for 7.4, 8.0, and 8.1.

The supported way off this page is an upgrade to 8.2.35, 8.3.36, 8.4.27, or 8.5.12. PHP 5 before 5.4 is not the lower bound in the Wiz, Google Cloud, or Cloudflare wording. It is still not a version to leave on the internet.

Supported branches

Is PHP 8.1 vulnerable?

PHP did not ship an 8.1 release on 21 October 2026. It did publish a minimal source backport for 8.1, which is evidence that 8.1 was in scope, not an installable package from php.net. CISA says to take PHP 8.1 and earlier offline if you cannot update. A vendor build can carry the backport without changing the upstream version number, so the version checker cannot see it.

Is PHP 7.4 or 8.0 vulnerable?

Same shape as 8.1: no new official release, and a minimal source backport exists for both. Expel, attributing the reading to the backports, treats 7.4, 8.0, and 8.1 as affected. Upgrade to 8.2.35 or newer, or confirm a vendor backport you can actually name.

Is PHP 5.4, or PHP 7.3 and older, vulnerable?

Wiz, Google Cloud, and Cloudflare describe impact from PHP 5.4 through the last pre-patch 8.5 builds. watchTowr’s pre-advisory FAQ said PHP 5, 7, and 8 in their entirety. Expel says PHP has not explicitly confirmed 7.3 and older in the material Expel reviewed. That row is a disagreement, not a clean bill of health. Do not leave those lines on the internet.

Which version fixes PHP 5 through 8.1?

No official PHP version in those lines does. The supported fixes are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Some vendors ship their own packages: 宝塔’s Linux notice names 7.4.34, 8.0.31, and 8.1.35, and those numbers are not PHP project releases.

Sources

Outbound links leave this site. We do not host exploit code.

News archive 2026: security advisory, 21 October 2026 — PHP project (php.net)
CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption — oss-security (Jakub Zelenka, PHP security team)
Today’s PHP security release, and how we’re strengthening PHP security — The PHP Foundation
Critical vulnerabilities in PHP require immediate patching (21 October 2026) — CISA
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet — Wiz Research
Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 — Google Cloud
Cloudflare deploys protections against php2shell vulnerability — Cloudflare
FAQ: PHP2Shell CVE-2026-109618 and CVE-2026-109619 (published 20 October 2026, updated 22 October 2026) — watchTowr
Notice: php2shell, critical PHP vulnerabilities (status as of 21 October 2026, 20:00 UTC) — Expel
PHP 与 Node.js 紧急安全更新公告（更新于 2026-10-22） — 宝塔面板 (BT Panel)