PHP2Shell Response Kit
Verification record

Sources, check dates and what each one supports

Every operational claim on this site points back to a document here. The check date is when the document was read in full, not when a search result appeared.

Last full review 24 October 2026 21 records Read in full

How these records are maintained

Sources are recorded with an ID, publisher, original URL, publication date where one is published, check date, the conclusions they support, and their limits. If a source becomes unreachable, the last verified conclusion and date stay in place and the problem is written into the maintenance record. A failed fetch is not treated as an empty result.

This site does not present a source as independent evidence of your environment. A vendor's statement about its own product is labelled as that vendor's statement.

PHP official sources

Primary notices, release records and PHP configuration manuals. These define the fixed versions and the vendor’s own mitigation guidance.

Security advisory: Critical remote code execution vulnerabilities, update now

https://www.php.net/archive/2026.php

Current PHP Group

Published
2026-10-21
Checked
2026-10-24
Products
PHP 8.2, PHP 8.3, PHP 8.4, PHP 8.5
Supports
  • The two critical vulnerabilities are CVE-2026-109618 and CVE-2026-109619.
  • Patched upstream releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
  • Web SAPIs listed as at risk include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
  • Interim measures reduce specific attack paths but are not a complete fix.
  • PHP 8.1 and older receive no further upstream updates; distributions and LTS vendors may backport.
Limit
The archive entry is dated 21 October. The PHP 8 ChangeLog lists the entries under 22 October; this kit records the announcement date and notes the discrepancy rather than inventing a single time.

Informational advisory: Session upload progress

https://www.php.net/archive/2026.php

Current PHP Group

Published
2026-10-23
Checked
2026-10-23
Products
PHP 8.2, PHP 8.3, PHP 8.4, PHP 8.5, PHP 8.6 RC
Supports
  • CVE-2026-115560 concerns session upload progress and can affect patched releases including 8.5.12.
  • The issue requires session.serialize_handler set to php_binary or php_serialize and switched at runtime to php with ini_set() before session_start().
  • PHP recommends session.upload_progress.enabled=0 until the next regular bugfix release.
  • A full advisory is expected with the next release.
Limit
Informational advisory only. It is not a fourth confirmed RCE in the original disclosure, but it changes what 'fully patched' means for configurations that switch serialisation handlers at runtime.

Supported Versions

https://www.php.net/supported-versions.php

Current PHP Group

Published
Not stated
Checked
2026-10-24
Products
PHP 8.2, PHP 8.3, PHP 8.4, PHP 8.5
Supports
  • PHP 8.2 is in security-fix-only support until 31 December 2026.
  • PHP 8.3 is in security-fix-only support until 31 December 2027.
  • PHP 8.4 and PHP 8.5 are in active support on the date checked.

PHP 8 ChangeLog (8.5.12, 8.4.27, 8.3.36, 8.2.35)

https://www.php.net/ChangeLog-8.php

Current PHP Group

Published
2026-10-22
Checked
2026-10-23
Products
PHP 8.2.35, PHP 8.3.36, PHP 8.4.27, PHP 8.5.12
Supports
  • The release entries name GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp as the security fixes.
  • The 8.5.12 entry also contains unrelated bug fixes; the presence of other changes does not widen the security scope.
Limit
ChangeLog section dates read 22 October while release announcements are dated 21 October. Both are recorded; the kit does not present the difference as a security finding.

PHP-FPM configuration directives

https://www.php.net/manual/en/install.fpm.configuration.php

Current PHP Group

Published
Not stated
Checked
2026-10-23
Products
PHP-FPM
Supports
  • php_admin_value and php_admin_flag in an FPM pool can set values that cannot be overridden by ini_set() or .user.ini.
  • Pool configuration is applied by the FPM master before request handling.

Session configuration directives

https://www.php.net/manual/en/session.configuration.php

Current PHP Group

Published
Not stated
Checked
2026-10-23
Products
PHP 8.2, PHP 8.3, PHP 8.4, PHP 8.5
Supports
  • session.upload_progress.enabled is a PHP_INI_PERDIR setting enabled by default.
  • session.serialize_handler controls the session serialisation format.

Vendor technical advisories

The GitHub Security Advisories published by the PHP security team. They describe mechanisms and affected SAPIs.

GHSA-w8hw-w9fx-j79w: RCE via OOM corruption

https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

Current PHP Security Team / GitHub

Published
2026-10-21
Checked
2026-10-23
Products
PHP < 8.2.35, PHP < 8.3.36, PHP < 8.4.27, PHP < 8.5.12
Supports
  • CVE-2026-109618 is rated CVSS v4.0 9.2 and can lead to unauthenticated RCE as the web worker account.
  • A complete RCE was validated over HTTP against mod_php.
  • FPM exits the child when request startup fails, but source analysis indicates exposure after normal startup.
  • Multipart requests without a usable Content-Length, many part headers and empty file controls are described attack strategies.
  • The only complete mitigation is updating to a patched release.

GHSA-6wmf-4rv5-p3rp: RCE via stale global state

https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

Current PHP Security Team / GitHub

Published
2026-10-21
Checked
2026-10-23
Products
PHP < 8.2.35, PHP < 8.3.36, PHP < 8.4.27, PHP < 8.5.12
Supports
  • CVE-2026-109619 is rated CVSS v4.0 9.2 and is a use-after-free reachable across requests handled by the same worker.
  • Confirmed impact includes heap use-after-free, memory disclosure and remote code execution with the worker's privileges.
  • Session-lifecycle RCE was validated against mod_php and FPM.
  • Fatal errors, OOM, failed require, timeouts and late diagnostics can be producers.
  • Restarting every worker is required after changing the recommended interim settings.

Distribution and platform packages

Package-level status. Distribution versions differ from upstream numbers; use the notice, not a bare comparison.

USN-8948-1 / USN-8948-2: PHP vulnerabilities

https://ubuntu.com/security/CVE-2026-109619

Current Ubuntu Security Team

Published
2026-10-21
Checked
2026-10-24
Products
Ubuntu 22.04, Ubuntu 24.04, Ubuntu 26.04, Ubuntu 26.10
Supports
  • Ubuntu published fixed PHP packages for 22.04, 24.04, 26.04 and 26.10.
  • Older Ubuntu releases have fixed packages available with Ubuntu Pro/ESM (and Legacy Support for 16.04 and 14.04).
  • Fixed package versions differ from upstream version numbers because Ubuntu packages carry their own revision suffix.

DSA-6574-1 / DLA-4848-1: PHP security updates

https://security-tracker.debian.org/tracker/CVE-2026-109619

Current Debian Security Team

Published
2026-10-21
Checked
2026-10-24
Products
Debian 12 bookworm, Debian 13 trixie
Supports
  • Debian trixie is fixed in php8.4 8.4.27-1~deb13u1 via DSA-6574-1.
  • Debian bookworm is fixed in php8.2 8.2.35-1~deb12u1 via DLA-4848-1.
  • Debian forky was still listed as vulnerable at the time checked.
Limit
Forky is a development suite. A missing fixed version there does not mean stable suites are unfixed.

CVE-2026-109618: Red Hat security page

https://access.redhat.com/security/cve/CVE-2026-109618

Limited Red Hat

Published
Not stated
Checked
2026-10-23
Products
Red Hat Enterprise Linux
Supports
  • Red Hat rates the issue Important with a CVSS v3 base score of 8.1.
  • Red Hat notes that RHEL commonly uses PHP-FPM rather than mod_php and describes reliable exploitation as difficult in practice under FPM.
  • No product impact table or fixed errata was listed on the page when checked.
Limit
Do not treat the absence of errata on this page as proof that no fix exists. Check the actual RHEL minor release and subscribed repositories, or ask the vendor.

Platform and deployment documentation

Hosting, container and WordPress documentation. Platform documentation explains mechanics, not the patch state of your account.

PHP vulnerabilities: WAF protection and what customers should do

https://blog.cloudflare.com/php-vulnerabilities-waf-protection

Current Cloudflare

Published
2026-10-21
Checked
2026-10-23
Products
Cloudflare WAF
Supports
  • Managed WAF rules were deployed before disclosure and cover CVE-2026-109618 and CVE-2026-109619.
  • Cloudflare states that customers should patch PHP even with WAF protections and that WAF does not replace the PHP fix.
  • Rule #6 covers the session upload progress issue only when the default session.upload_progress.name is used.
Limit
Vendor description of its own protection. It is not independent evidence that any particular origin is protected or that a request was blocked.

Official PHP image versions feed

https://raw.githubusercontent.com/docker-library/php/master/versions.json

Current Docker Official Images / php-src packaging

Published
Not stated
Checked
2026-10-23
Products
php Docker image
Supports
  • Stable entries for 8.2.35, 8.3.36, 8.4.27 and 8.5.12 are present in the official image version feed.
  • 8.6 is listed only as a release candidate, not a stable branch.
Limit
A tag existing does not prove a running container uses it. Compare the running image digest, not the tag name.

PHP and WordPress: compatibility and updating

https://developer.wordpress.org/advanced-administration/server/php/

Current WordPress Developer Resources

Published
Not stated
Checked
2026-10-23
Products
WordPress
Supports
  • WordPress recommends testing PHP changes in a staging environment before production.
  • On shared hosting, PHP configuration and limits are often controlled by the host, not the site owner.
  • Plugin and theme compatibility is the main reason to test before changing PHP versions.
Limit
The page is general administration guidance, not a statement that any particular WordPress version is patched against PHP2Shell. PHP is patched by the runtime provider.

Cloudflare Pages: custom domains

https://developers.cloudflare.com/pages/configuration/custom-domains/

Current Cloudflare

Published
Not stated
Checked
2026-10-23
Products
Cloudflare Pages
Supports
  • A Pages custom domain requires the apex domain's DNS zone to be active in the same Cloudflare account, or a CNAME for a subdomain.
  • Domain binding is not complete until the platform shows the domain as active.

Cloudflare Pages: redirects

https://developers.cloudflare.com/pages/configuration/redirects/

Current Cloudflare

Published
Not stated
Checked
2026-10-23
Products
Cloudflare Pages
Supports
  • Static redirects are declared in a _redirects file in the build output.
  • Platform redirect rules and DNS records can also affect host-level behaviour and must be checked together.

Docker image digests

https://docs.docker.com/dhi/explore/security-concepts/digests/

Current Docker Docs

Published
Not stated
Checked
2026-10-24
Products
Docker images, OCI images
Supports
  • Tags can be reused or changed; a digest is immutable.
  • A multi-platform tag points to a manifest list (index) that references per-platform image digests.
  • The manifest-list digest identifies the overall multi-platform image; each platform image has its own digest.
  • docker buildx imagetools inspect shows the overall digest and the per-platform manifests.

Building multi-platform images

https://docs.docker.com/build/building/multi-platform/

Current Docker Docs

Published
Not stated
Checked
2026-10-24
Products
Docker Buildx, OCI images
Supports
  • A multi-platform image uses a manifest list pointing to multiple per-platform manifests.
  • Each per-platform manifest points to its own configuration and layer set.
  • A registry stores the manifest list and the individual manifests; Docker selects the variant for the host platform when pulling.

Docker Engine API: container and image inspect fields

https://github.com/moby/moby/blob/master/api/swagger.yaml

Current Docker / Moby

Published
Not stated
Checked
2026-10-24
Products
Docker Engine API
Supports
  • A container's Image field is the image reference or ID used at creation; newer engines also expose ImageID and ImageManifestDescriptor.
  • An image Id is a content-addressable digest calculated from the image configuration, distinct from RepoDigests.
  • RepoDigests holds digests of image manifests that reference the image and is usually available only after a pull or push.
  • ImageManifestDescriptor, when available, is the OCI descriptor of the platform-specific manifest used to create the container.
Limit
The Swagger schema is the authoritative field description. `docker inspect` template names vary slightly across engine versions; the guide asks the reader to confirm the field on their engine.

Search and indexing background

References used for the site’s indexing decisions. They are not evidence about PHP2Shell.

Consolidate duplicate URLs with canonical links

https://developers.google.com/search/docs/crawling-indexing/consolidate-duplicate-urls

Current Google Search Central

Published
Not stated
Checked
2026-10-23
Products
Search indexing
Supports
  • Canonical signals, redirects and sitemap entries should agree with each other.
  • Canonical is a hint, not a directive that guarantees consolidation.

AI features and your website

https://developers.google.com/search/docs/appearance/ai-features

Current Google Search Central

Published
Not stated
Checked
2026-10-23
Products
Search indexing
Supports
  • Google states there are no additional technical requirements specific to appearing in AI features beyond existing Search fundamentals.
  • Inclusion in AI features is not guaranteed by markup or file conventions.

What is not confirmed

  • Alpine Linux: no stable package page was retrieved at the check date. Do not treat the package as fixed or unfixed without checking the exact repository and branch.
  • Red Hat: the CVE page showed no product impact table or fixed errata when read. Check the exact RHEL release and repositories.
  • Managed hosts: no provider-specific package or restart confirmation was verified. A host’s own reply is the evidence to obtain.
  • WordPress: the documentation confirms compatibility guidance, not a PHP2Shell fix. The runtime is patched by the host or image.

See what changed on this site.