Is PHP2Shell fixed on AlmaLinux 10?

Status as of October 26, 2026: Reported by AlmaLinux OS Foundation; not confirmed in a second primary source as of October 26, 2026.

The short answer

Stated in one source only, so not confirmed as of October 26, 2026: Default PHP (8.3): php-8.3.33-1.el10_2.alma.1; php8.4: php8.4-8.4.24-1.el10_2.alma.1; AlmaLinux Kitten 10: No separate build: AlmaLinux says the fix will ride along in the next regular PHP update. A fixed package only counts once it’s installed and PHP has restarted (source: AlmaLinux). A related flaw, CVE-2026-115560, has no fix in any PHP release as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).

Fix status on AlmaLinux 10

How to check on AlmaLinux 10 (read-only)

Run these on the server. They only read package data and configuration files; none of them change anything. Red Hat’s bulletin adds that you should confirm the running values with a temporary phpinfo() page (delete it straight afterwards), rather than php -i, which reads only the command-line configuration.

# 2. Installed PHP packages and their versions
rpm -qa 'php*' --qf '%{NAME} %{VERSION}-%{RELEASE}\n' | sort

# 3. Does the changelog name both CVEs?
rpm -q --changelog php-common | grep -E 'CVE-2026-1096(18|19)'
rpm -q --changelog php8.4-common | grep -E 'CVE-2026-1096(18|19)'   # if you use php8.4

# 4. When was it updated, and has PHP restarted since?
rpm -q --last php-common
systemctl show php-fpm -p ActiveEnterTimestamp
httpd -M 2>/dev/null | grep -E 'mpm_|php'   # is Apache running PHP as a module (mod_php)?

# 5. CVE-2026-115560: is the setting in the configuration files?
grep -rns 'session.upload_progress.enabled' /etc/php* /etc/php-fpm* 2>/dev/null

Check the PHP that serves your website, not just the command line: they can be different builds (source: AlmaLinux). The five checks that count as proof.

CVE-2026-115560

On October 23, 2026, PHP disclosed a related flaw, CVE-2026-115560, that the October 21 releases don’t fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. Setting it from application code (ini_set()) or a per-directory .user.ini file doesn’t count (source: php.net advisory on CVE-2026-115560, October 23, 2026).

On AlmaLinux 10: AlmaLinux’s announcement doesn’t mention CVE-2026-115560. It does give session.upload_progress.enabled = 0 as a mitigation step for PHP2Shell, in /etc/php.d/99-php2shell.ini. (AlmaLinux OS Foundation)

Notes for AlmaLinux 10

• AlmaLinux says to check with rpm -q php8.4-common for PHP 8.4 on AlmaLinux 10, and not to rely on php -v (source: AlmaLinux).
• AlmaLinux’s errata files were too large for us to read and its errata page shows no listing (24 and October 26, 2026), so we couldn’t confirm these builds in a second AlmaLinux document.

Sources (checked October 26, 2026)

• AlmaLinux OS Foundation: PHP2Shell (CVE-2026-109618, CVE-2026-109619) announcement. Page date: Oct 21, 2026 (last changelog entry 21:15 UTC). States: Per-release, per-stream build list; ‘Install the version listed for your release and stream, or higher’; verify with rpm -q php-common, not php -v.

Upstream facts (fixed releases, CVE-2026-115560, end-of-life dates) are footnoted to /sources. We list a build as confirmed only when two different primary documents state it. Method.

Related

Red Hat Enterprise Linux 10 · Rocky Linux 10 · AlmaLinux 9 · All platforms · How to prove your server is patched · What to ask your host or developer

Want it checked for you?

• Patch Verification & Compromise Review. Collection is read-only, and we change nothing on your server. You get a plain-English report: where each fix stands, as of a stated time, plus a compromise review from October 17, signed by the Approver of Record. Ask for it
• Check it yourself, free. The read-only steps are on our PHP2Shell page. Our open-source self-check script is publishing soon.