Vendor status
PHP2Shell vendor status: who patched and who is investigating
These are vendor statements about their own products, read on 22 October 2026. A fixed package in a distribution does not mean every PHP binary on a server came from that distribution. A vendor that says “no products known to be affected” is reporting the state of an investigation, not a permanent finding.
Last updated
| Vendor | What that vendor says | Source date |
|---|---|---|
| Cisco | Investigating which products and cloud services may be affected. As published, no products are known to be affected, and the “confirmed not vulnerable” section was still empty. PSIRT says it is not aware of malicious use of these vulnerabilities against Cisco. No workaround that addresses the bugs. | First published 21 October 2026, 19:12 GMT |
| Red Hat | Partly fixed. RHSB-2026-013 says Red Hat is expediting fixes, some updates are already available, and additional updates are in progress. RHEL 10, 9, 8, and OpenShift Dev Spaces 3 are listed as directly affected. Standard RHEL PHP-FPM is described as harder to exploit than mod_php. Errata including RHSA-2026:87151 (RHEL 9 php), RHSA-2026:87080 (RHEL 8 php), and RHSA-2026:87079 (RHEL 9 php:8.3) name both CVEs. The bulletin says the investigation is ongoing. | Public 21 October 2026 |
| Ubuntu | Fixed for supported releases, including Ubuntu Pro and legacy ESM builds back to 14.04’s php5. Examples Ubuntu lists: 24.04 php8.3 in 8.3.6-0ubuntu0.24.04.13, 22.04 php8.1 in 8.1.2-1ubuntu2.28, 26.04 php8.5 in 8.5.4-0ubuntu1.5. The upstream version number often does not change. Restart PHP-dependent services after upgrading. | Blog post 21 October 2026 |
| cPanel | Fixed for the builds cPanel lists. The 22 October article says updates for ea-php74 and above have been released, including ea-php82 8.2.35, ea-php83 8.3.36, ea-php84 8.4.27, and ea-php85 8.5.12, plus backports ea-php74 7.4.33-19, ea-php80 8.0.30-12, and ea-php81 8.1.34-5. cPanel & WHM patched versions listed include 11.110.0.153, 11.134.0.66, 11.136.0.50, and 11.138.0.18. PHP older than 7.4 is pointed at TuxCare ELS. A CloudLinux table in the same article is explicitly deferred to CloudLinux’s status page. | Updated 22 October 2026 |
| Plesk | Fixed, with a build-date caveat on old branches. Plesk says Linux and Windows fixes are available for PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. End-of-life 7.4.33, 8.0.30, and 8.1.34 keep the same version number; builds dated 21 October 2026 include the fix. The panel’s own sw-engine is fixed in Plesk Obsidian 18.0.81 Update 4 and 18.0.80 Update 11. | Vendor article citing the 21 October PHP release |
| Sophos | Sophos products: not affected. Advisory sophos-sa-20261021-php2shell says no Sophos product is affected and no action is required for those products. Separately, the legacy MyUTM licensing portal ran an affected PHP version; Sophos took it offline on 21 October and says a log review has found no evidence of exploitation so far, with the review still open. | Updated 21 October 2026 |
How to read “fixed”
Ubuntu’s fixed 24.04 package is still PHP 8.3.6, with a new package revision. Plesk’s fixed 7.4, 8.0, and 8.1 builds keep their version numbers and change the build date. Comparing `php -v` with 8.3.36 will mislabel those hosts. Use the package string or build date the vendor published, then restart the SAPI that answers HTTP. The version checker only compares upstream release numbers. It will not recognize a backport.
No public disclosure of a compromised well-known site
As of 22 October 2026, the sources reviewed for this page do not include a public disclosure that a well-known website was compromised through PHP2Shell. Reuters, quoting Cloudflare, reported millions of exploit attempts and described government sites in Europe and elsewhere going offline, plus temporary suspensions at Mitsubishi UFJ Financial Group and Japan’s Finance Ministry, as operators scrambled and applied emergency measures. Sophos says its offline MyUTM portal has, so far, shown no evidence of exploitation. AWS says it is unclear whether the attempts it saw would have succeeded on real systems. CISA said it had not observed exploitation as of its 21 October alert. Absence of a named-victim disclosure is not evidence that no compromise has happened. It is a statement about what these sources have published.
Sources
Outbound links leave this site. We do not host exploit code.
- Vulnerabilities in PHP affecting Cisco products: October 2026 — Cisco
- RHSB-2026-013 php2shell request-handling memory corruption — Red Hat
- php2shell — PHP critical vulnerability fixes available — Ubuntu
- Critical PHP security release — CVE-2026-109618 and CVE-2026-109619 — cPanel
- Remote code execution in PHP shipped with Plesk — Plesk
- Advisory: PHP2Shell vulnerabilities (sophos-sa-20261021-php2shell) — Sophos
- Cloudflare sees millions of exploit attempts after PHP disclosure, 22 October 2026 — Reuters (syndicated text)
- News archive 2026: security advisory, 21 October 2026 — PHP project (php.net)