Every branch, its end of life and the PHP2Shell fix
PHP2Shell is the name used for CVE-2026-109618 and CVE-2026-109619, two critical flaws in PHP itself. The PHP project fixed them on 21 October 2026. The table shows where each branch stands now.
| Branch | Upstream support ends | PHP2Shell fix from the PHP project | Page |
|---|---|---|---|
| 8.5 | 31 Dec 2029 | Release 8.5.12 | |
| 8.4 | 31 Dec 2028 | Release 8.4.27 | |
| 8.3 | 31 Dec 2027 | Release 8.3.36 | PHP 8.3 |
| 8.2 | 31 Dec 2026 | Release 8.2.35 | PHP 8.2 |
| 8.1 | 31 Dec 2025 | Source backport only | PHP 8.1 |
| 8.0 | 26 Nov 2023 | Source backport only | Old versions |
| 7.4 | 28 Nov 2022 | Source backport only | PHP 7.4 |
| 7.3 | 6 Dec 2021 | None | Old versions |
| 7.2 | 30 Nov 2020 | None | Old versions |
| 7.1 | 1 Dec 2019 | None | Old versions |
| 7.0 | 10 Jan 2019 | None | Old versions |
| 5.6 | 31 Dec 2018 | None | PHP 5 |
Dates come from php.net's supported-versions and unsupported-branches pages. 8.2 and 8.3 are in the security-only phase; 8.4 and 8.5 are in active support.
"Source backport" means the PHP project published a branch named like PHP-7.4-CVE-2026-109618-109619 that holds only the two fixes. It is source code. There is no release and no package, so someone has to compile it. Details are on the PHP 7.4 page.
End of life upstream does not mean unpatched
When the PHP project ends a branch, it stops publishing releases. Anyone else can still patch their own builds. Distributions, control panel vendors and paid support companies often keep fixing the PHP version they ship, for as long as their own release is supported.
So a server can report PHP 7.4 or 8.1 and still be fixed, and the same goes for a server that reports a version below 8.2.35. The version string alone does not tell you. Check the package changelog.
Status at our last check on 21 October 2026:
| Source | Old branches | Status at last check |
|---|---|---|
| Ubuntu | 22.04 php8.1 | Fixed in the normal archive (USN-8948-1) |
| Ubuntu with Ubuntu Pro (ESM) | 20.04 php7.4, 18.04 php7.2 | Fixed (USN-8948-2). 16.04 and 14.04 need Pro plus the Legacy Support add-on |
| Debian | 12 php8.2 (LTS) | Fixed in 8.2.35-1~deb12u1 (DLA-4848-1). 11 php7.4 was not listed in the tracker |
| Red Hat Enterprise Linux | 8 module php:7.4 | Fixed (RHSA-2026:87080). php:8.2 and RHEL 9 and 10 had no fix yet |
| CloudLinux alt-php | 5.2 to 8.5 | "In preparation". Only alt-php74 builds were listed as shipped |
| cPanel EasyApache 4 | ea-php74, 80, 81 | Backported fixes in 25.91, both CVEs listed |
| Plesk | 7.4, 8.0, 8.1 | No fix yet |
| Sury | 8.1, 8.0, 7.4 on Ubuntu 22.04 and 24.04 | Published 21 Oct. We did not verify the 8.1 and 8.0 changelogs |
| Docker official image | 8.1 and older | Not patched |
| Windows builds | 8.1.34, 8.0.30, 7.4.33 | Not patched |
| Homebrew | php@8.1 | Not patched |
Two cautions. Vendors update their pages often, so open the vendor page linked from each distro guide before you rely on a row. Also, a "no fix planned" notice, like the one Amazon Linux lists for PHP 8.1 on Amazon Linux 2023, means the package stays vulnerable.
To verify a distribution package, check its changelog, then restart PHP:
apt changelog php8.1-fpm | grep -m1 -E 'CVE-2026-10961[89]' # Debian, Ubuntu
rpm -q --changelog php-fpm | grep -m1 -E 'CVE-2026-10961[89]' # RHEL family
Changelogs from Remi's repository and from Sury may not name the CVEs. For those, compare the installed version with the fixed one. The after patching guide shows how to check the running version.
Paid extended support
Companies such as TuxCare, HeroDevs and Zend sell patched builds of PHP after upstream ends. At our last check, HeroDevs named both CVEs for PHP 7.4, 8.0 and 8.1 on its own pages. Zend's fix for its long-term builds was reported only second-hand. We found nothing from TuxCare. Before you pay, ask for written confirmation that both CVE numbers are covered. The comparison is on old PHP versions.
Your options
1. Upgrade. This is the only option that also covers the next flaw. We recommend PHP 8.4, or 8.3 if a plugin or extension is not ready. Avoid moving to 8.2: it ends on 31 December 2026. Guides: 7.4 to 8.4, 8.1 to 8.4, 8.2 to 8.4. See all upgrade guides.
2. Use a distribution backport. It is free or included in a subscription, and it lasts until your OS release ends. The version string stays old, so check the changelog as shown above.
3. Buy vendor extended support. This is for code that cannot move yet. Pick a vendor that confirms both CVEs in writing. See old PHP versions.
4. Let the host manage it. On shared and managed hosting, the host runs PHP. Ask which build serves your site and when workers were restarted: the three questions are on the triage page and the shared hosting guide. Many hosts let you pick a newer PHP in the panel; that is the quickest fix there. Host-by-host statements are on hosts.
If none of these works for a site this week, take it off the public internet or put it behind a VPN or a login at the proxy. That reduces exposure but does not fix anything. The cannot upgrade yet guide lists the official temporary settings.
Pick your branch
- PHP 8.3: fixed in 8.3.36, supported to 2027.
- PHP 8.2: fixed in 8.2.35, ends 31 December 2026.
- PHP 8.1: source backport, ended 31 December 2025.
- PHP 7.4: source backport, ended 28 November 2022.
- PHP 5: nothing from the PHP project.
- Old versions and extended support: 8.0, 7.x and vendors.
Last reviewed on 22 October 2026.