Blog · 3 min read
Five version numbers, one fix: how to read PHP2Shell patch versions
On this page
The short answer
The PHP2Shell fix appears under many version numbers. PHP’s own fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (source: php.net release archive). But Linux distributions and hosts often ship the same fix as a backport that keeps an older number. A version number can’t prove whether PHP is patched (source: AlmaLinux). So a server reporting “8.3.6” can be fixed, and one reporting a higher number can be unpatched if PHP hasn’t restarted. Read the version as a clue to which kind of build you have, then check the evidence that build provides.
Five numbers that can carry the same fix
| What you see | What it is | Example | What proves the fix |
|---|---|---|---|
| 8.4.27 | PHP’s own release | PHP’s fixed releases: 8.5.12, 8.4.27, 8.3.36, 8.2.35 (source: php.net release archive) | The number itself, at or above the fixed release for its branch, plus a restart |
| 8.4.27-1~deb13u1 | A distribution package rebased on PHP’s release | Debian 13 (trixie), DSA-6574-1 (Debian tracker) | The distribution’s advisory or package changelog, plus a restart |
| 8.3.6-0ubuntu0.24.04.13 | A backport onto an older upstream version | Ubuntu 24.04, USN-8948-1 (Ubuntu notice). Below 8.3.36, yet fixed | The distribution’s advisory or package changelog. Not the upstream number |
| 8.1.2-1ubuntu2.28 | A backport on a branch PHP no longer fixes | Ubuntu 22.04, USN-8948-1 (Ubuntu notice). No official PHP release fixes 8.1 (source: Beazley Security Labs) | The distribution’s advisory or package changelog |
| No change at all | A host or vendor patched in place | Xserver patched PHP 5.6 to 8.1 without changing version numbers; CloudLinux says its backports keep lower version numbers (source: AlmaLinux) | The host’s written confirmation, or the vendor’s changelog |
Why the number misleads in both directions
A low number can be fixed. In the third and fourth rows, the upstream part of the version is far below PHP’s fixed release, and the package is fixed anyway. A scanner that compares version strings against 8.3.36 will flag that server even though it’s patched.
A high number can be unpatched. Three ways this happens:
- The package on disk is fixed, but PHP’s worker processes haven’t restarted, so the old code is still running (source: AlmaLinux).
- The command-line
php -vreports one build while the website runs another (source: AlmaLinux). - A container was rebuilt but the running container wasn’t recreated from the new image.
What to read instead
For each PHP runtime that serves your website, collect:
- The build actually serving the site, read from the web PHP, not the command line (source: AlmaLinux).
- The fix’s paper trail: for PHP’s own releases, the version; for distribution and vendor builds, the advisory ID or a package changelog entry naming CVE-2026-109618 and CVE-2026-109619.
- A restart after the update.
- PHP’s recommended setting for CVE-2026-115560, which no PHP release fixes as of October 23, 2026:
session.upload_progress.enabled=0in the server configuration, then a restart (source: php.net advisory on CVE-2026-115560, October 23, 2026).
The five checks, step by step.
On shared hosting
You usually can’t see the package at all. Many shared and managed hosts reported patching PHP on their managed plans (source: GoDaddy), and many hosts ship the fix as a backport that keeps the old version number (source: AlmaLinux). Ask for written confirmation for your account, with a date and a restart. The questions to ask.
Sourced facts
Full wording, primary sources and dates: /sources. Distribution version strings: stat-sheet technical reference data, cited to the vendor pages above.
| ID | Fact | Primary source | Date |
|---|---|---|---|
| S-02 | PHP’s fixed releases: 8.5.12, 8.4.27, 8.3.36, 8.2.35 | php.net | Oct 21, 2026 |
| S-09 · Q-12 | A version number can’t prove a patch; backports keep old numbers | AlmaLinux · CloudLinux · Xserver | Oct 21–23, 2026 |
| S-03 | No official PHP release fixes 8.1 or older | Beazley | Oct 21–23, 2026 |
| S-02b | CVE-2026-115560 unfixed; interim setting | php.net | Oct 23, 2026 · LIVE |
| S-05b | Many managed hosts reported patching managed plans | Hostinger | Oct 21–23, 2026 · LIVE |
| §R | Ubuntu 24.04 php8.3 8.3.6-0ubuntu0.24.04.13; 22.04 php8.1 8.1.2-1ubuntu2.28 (USN-8948-1); Debian 13 php8.4 8.4.27-1~deb13u1 (DSA-6574-1) | Ubuntu USN-8948-1 · Debian tracker | Oct 21, 2026; checked Oct 24, 2026 |
Want someone to read the numbers for you?
- Patch Verification & Compromise Review. Read-only: we verify and document. With your written authorization, your developer or host gives us read-only access: a dedicated login that can look but not change anything, shared through a secure link, never by email. We change nothing on your server, and you get a plain-English report: a timestamped status per CVE for every PHP runtime on the server. Ask for it
- Check it yourself, free: the read-only steps are on our PHP2Shell page.