The short answer
PHP fixed PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on October 21, 2026 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (source: php.net release archive). Most servers don’t run PHP’s own builds. They run a Linux distribution’s package, a control panel’s build or a host’s managed PHP, and those often carry the fix under an older version number (source: AlmaLinux). This page tracks, platform by platform, which fixed builds have been published and where the fix is confirmed. It also shows what to check on your own server. A related flaw, CVE-2026-115560, has no fix in any PHP release as of October 23, 2026; PHP recommends session.upload_progress.enabled=0 in the server configuration, then a restart (source: php.net advisory on CVE-2026-115560, October 23, 2026).
Linux distributions
Control panels and vendor builds
| Platform |
Status |
Fixed build (example) |
Advisory or statement |
| CloudLinux alt-php |
Partly confirmed |
Fixed builds in the stable channel (branch level) |
CloudLinux advisory; TuxCare post |
| cPanel EasyApache 4 (ea-php) |
Partly confirmed |
Fixed in EasyApache 4 25.91 (Oct 21, 2026) |
cPanel release notes; CloudLinux advisory |
| Plesk (Linux) |
Not confirmed (one source) |
8.5.12, 8.4.27, 8.3.36, 8.2.35 |
Plesk Obsidian change log, PHP Updates, Oct 21, 2026 |
| Remi’s RPM repository |
Not confirmed (one source) |
8.5.12, 8.4.27, 8.3.36, 8.2.35 |
Remi’s release post, Oct 22, 2026 |
| Docker Official Images: php |
Partly confirmed |
8.5.12, 8.4.27, 8.3.36, 8.2.35 (cli, apache, fpm and zts variants) |
docker-library official-images and versions files |
Managed hosts
| Platform |
Status |
Fixed build (example) |
Advisory or statement |
| GoDaddy |
Partly confirmed |
Host reports patching all PHP versions (Oct 21–22, 2026) |
GoDaddy status page and news article |
| Hostinger |
Confirmed |
Host reports patched builds rolled out, completed Oct 22, 2026 06:44… |
Hostinger blog and status page |
| SiteGround |
Not confirmed (one source) |
Host reports applying PHP’s official fixes on Oct 21, 2026 |
SiteGround blog |
| WP Engine |
Not confirmed (one source) |
Host reports running patched PHP from its enterprise PHP LTS provider |
WP Engine blog, Oct 22, 2026 |
| WordPress.com |
Confirmed |
Host reports PHP is patched by WordPress.com at the infrastructure… |
WordPress.com blog and Automattic post, Oct 21, 2026 |
| Xserver |
Not confirmed (one source) |
Host reports fixes applied for PHP 5.1–8.5 on all target servers (c… |
Xserver notice, Oct 21–26, 2026 |
| Sakura Internet |
Partly confirmed |
Web UI features suspended in response to the PHP vulnerability |
Sakura notice and Sakura Cloud news |
| Lolipop |
Partly confirmed |
PHP’s fixed releases: 8.2.35, 8.3.36, 8.4.27, 8.5.12 |
Lolipop notices 8237 and 8239, Oct 21–22, 2026 |
How we verify
- Two primary sources, or it’s not confirmed. A primary source is the platform’s own security tracker, advisory, release notes, change log or status page, or php.net. We list a build as confirmed only when two different primary documents state it. If we found one, the page says “not confirmed in a second primary source”. If we found none, it says “not confirmed”. We never fill a gap with a guess.
- “Can’t tell from version.” We mark a row this way unless two primary documents name the exact fixed build. That covers rows with one source, and fixes that keep the old version number (backports and host-side patches). Then the version your server reports proves nothing either way: check the installed package’s changelog for the CVE IDs, or ask your host in writing (source: AlmaLinux; GoDaddy).
- Dated. Every page shows when its sources were last checked. We re-check every source at least every 7 days while CVE-2026-115560 is unfixed, and on the same day when a platform publishes a change.
- What “fixed” means here. A platform has published a fixed build. It doesn’t mean your server runs it. That takes the update, a restart, and the CVE-2026-115560 setting (source: AlmaLinux; php.net advisory on CVE-2026-115560, October 23, 2026). How to prove your server is patched.
- Hosts. A host’s statement covers its managed platform. If you run your own VPS or server, nobody patches PHP for you (source: GoDaddy).
- Corrections. If a platform has published something we’ve missed, tell us at corrections@oakshield.co and we’ll check it.
Want it checked for you?
- Patch Verification & Compromise Review. Collection is read-only, and we change nothing on your server. You get a plain-English report with where each fix stands as of a stated time. Ask for it
- Check it yourself, free. The read-only steps are on our PHP2Shell page. Our open-source self-check script is publishing soon.
Change log
- October 26, 2026: re-verification pass. All sources re-read. Added Red Hat’s Extended Update Support, Update Services for SAP Solutions, AUS and TUS builds (now confirmed in their advisories), Rocky Linux 9 and Rocky Linux 8 php:7.4, Xserver’s October 26 update, CloudLinux’s October 23 repository correction, and a second Lolipop notice. Rows not confirmed in two primary sources are marked “Can’t tell from version”.
- October 24, 2026: first verification pass across 29 platforms.
