Are you affected?
Yes. Every PHP 7.4 build is affected unless the backport has been applied to it. Both flaws are in PHP itself, so every site on the server is exposed, whatever it runs.
The exception is a distribution or vendor that patched its own 7.4 package. Ubuntu 20.04 and Debian 11 shipped PHP 7.4, and RHEL 8 offers it as an AppStream module. Those vendors patch it within their own support periods, some only under paid plans such as Ubuntu Pro. If your package comes from there, its security notice for both CVE numbers tells you whether you are covered. The version string will still read 7.4.
The official fix, and its limit
PHP 7.4 reached end of life on 28 November 2022. The PHP project will not publish a 7.4 release for PHP2Shell.
Instead, the PHP project published a minimal source branch, PHP-7.4-CVE-2026-109618-109619, in the php-src repository. It contains the two fixes and nothing else.
A source branch is not a package
To use it you compile PHP yourself, with the same extensions and options as your current build, then keep doing that for every future flaw. That is unrealistic for most sites. The branch is meant for distributions and vendors.
Free ways out, in order of effort
1. Check whether your package is already patched. On Ubuntu or Debian:
php -v
apt changelog php7.4-fpm | grep -E 'CVE-2026-10961[89]'
If both numbers appear, restart PHP. You are then covered for these two flaws:
sudo systemctl restart php7.4-fpm
2. Upgrade to a supported branch. 8.3.36 or 8.4.27 fix PHP2Shell and are supported until 2027 and 2028. Moving from 7.4 to 8.x is a real migration. PHP 8.0 removed and changed enough that old plugins and libraries often break. Test on a copy first, and go to 8.3 rather than 8.1 or 8.2. The steps are on PHP 8.3.
3. On shared hosting, switch the PHP version in your control panel to 8.3 or newer, then confirm it took effect. The questions to ask your host are on the triage page.
If you cannot upgrade today
The official temporary settings apply to 7.4 as well. They reduce exposure without making the server safe:
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 8M ; 32M if the site takes uploads
php_admin_value[upload_max_filesize] = 4M
php_admin_value[max_input_nesting_level] = 16 ; default 64; lower it
php_admin_flag[session.upload_progress.enabled] = off
php_admin_flag[log_errors] = on
php_admin_value[error_reporting] = E_ALL
Set them in php.ini or the FPM pool, not .user.ini, and restart every worker. Add request limits at the proxy. Do not set RLIMIT_AS or RLIMIT_DATA. The reasons for each line are on the home page.
When you need someone else
- Extended support. Vendors such as TuxCare, HeroDevs and Zend sell patched builds of old PHP. HeroDevs has confirmed both CVEs for its 7.4, 8.0 and 8.1 builds. When we checked, Zend and TuxCare had not done so on their own sites. Compared on old PHP versions.
- A planned move to 8.3. We can scope it with you, in writing, invoiced.
Last reviewed on 22 October 2026.