Where each old branch stands
| Branch | Support ended | What the PHP project offers for PHP2Shell |
|---|---|---|
| 8.1 | 31 December 2025 | Source branch PHP-8.1-CVE-2026-109618-109619 |
| 8.0 | 26 November 2023 | Source branch PHP-8.0-CVE-2026-109618-109619 |
| 7.4 | 28 November 2022 | Source branch PHP-7.4-CVE-2026-109618-109619 |
| 7.3 and older | Earlier | Nothing |
A source branch is only code. Someone has to compile it and ship it as a package: you, your distribution or a vendor. Branch pages: 8.1, 7.4.
"Upstream end of life" does not always mean "no patch". Your distribution may still maintain the version it shipped.
Four ways forward
1. Upgrade to a supported branch
This is the only option that also covers the next flaw. 8.3.36 and 8.4.27 fix PHP2Shell and are supported until the end of 2027 and 2028. Cost: testing time, sometimes code changes. Steps: PHP 8.3.
2. Use your distribution's package
Ubuntu, Debian, Red Hat and CloudLinux patch the PHP versions they ship for as long as that release is supported, some only under paid plans such as Ubuntu Pro. Cost: often nothing. Limit: only while your OS release is supported, and the version string never changes, so you check the security notice for both CVE numbers.
3. Pay for extended support
Vendors keep patching PHP after the project stops:
- TuxCare ELS covers PHP 5.2 to 8.1, also sold as an add-on by some hosts and as a Plesk extension.
- HeroDevs NES covers PHP 7.2 to 8.2 and states a 14-day target for critical CVEs.
- Zend sells long-term support for 8.1, among others.
Who has confirmed these two CVEs
As of 22 October 2026: HeroDevs names both CVEs for its PHP 7.4, 8.0 and 8.1 builds in a post and in its vulnerability directory, dated 21 October. Zend has only been quoted second-hand as fixing its LTS builds; we found no statement on its own site. TuxCare's CVE tracker had no entry for either CVE when we checked. Ask before you buy, and get the answer in writing.
We have no paid relationship with any of them today. If that changes, links will be marked "Paid link" and listed on disclosure.
4. Isolate what you cannot move
For an internal tool that cannot be upgraded this month: take it off the public internet, put it behind a VPN or authentication at the proxy, and apply the temporary settings. This reduces exposure. It is not a fix.
What we would do
On a server you control, upgrade to 8.3 and use the time you save on everything else. If the code truly cannot move, pick a vendor that confirms coverage of both CVEs in writing. If you want help deciding, write to us.
Last reviewed on 22 October 2026.