Is PHP2Shell fixed on AlmaLinux 8?

Status as of October 26, 2026: Reported by AlmaLinux OS Foundation; not confirmed in a second primary source as of October 26, 2026.

The short answer

Stated in one source only, so not confirmed as of October 26, 2026: php:8.2 stream: php-8.2.33-1.module_el8.10.0+4320+c30d6dbb.alma.1; php:7.4 stream: php-7.4.33-8.module_el8.10.0+4321+cf5fd4bb; php:7.2, 7.3 and 8.0 streams (retired): Builds listed by AlmaLinux (7.2.24-1…alma.1, 7.3.20-1…alma.1, 8.0.30-1…alma.1). A fixed package only counts once it’s installed and PHP has restarted (source: AlmaLinux). A related flaw, CVE-2026-115560, has no fix in any PHP release as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).

Fix status on AlmaLinux 8

How to check on AlmaLinux 8 (read-only)

Run these on the server. They only read package data and configuration files; none of them change anything. Red Hat’s bulletin adds that you should confirm the running values with a temporary phpinfo() page (delete it straight afterwards), rather than php -i, which reads only the command-line configuration.

# 1. Enabled PHP module stream (-C reads the local cache, no network)
dnf -C module list --enabled php

# 2. Installed PHP packages and their versions
rpm -qa 'php*' --qf '%{NAME} %{VERSION}-%{RELEASE}\n' | sort

# 3. Does the changelog name both CVEs?
rpm -q --changelog php-common | grep -E 'CVE-2026-1096(18|19)'

# 4. When was it updated, and has PHP restarted since?
rpm -q --last php-common
systemctl show php-fpm -p ActiveEnterTimestamp
httpd -M 2>/dev/null | grep -E 'mpm_|php'   # is Apache running PHP as a module (mod_php)?

# 5. CVE-2026-115560: is the setting in the configuration files?
grep -rns 'session.upload_progress.enabled' /etc/php* /etc/php-fpm* 2>/dev/null

Check the PHP that serves your website, not just the command line: they can be different builds (source: AlmaLinux). The five checks that count as proof.

CVE-2026-115560

On October 23, 2026, PHP disclosed a related flaw, CVE-2026-115560, that the October 21 releases don’t fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. Setting it from application code (ini_set()) or a per-directory .user.ini file doesn’t count (source: php.net advisory on CVE-2026-115560, October 23, 2026).

On AlmaLinux 8: AlmaLinux’s announcement doesn’t mention CVE-2026-115560. It does give session.upload_progress.enabled = 0 as a mitigation step for PHP2Shell, in /etc/php.d/99-php2shell.ini. (AlmaLinux OS Foundation)

Notes for AlmaLinux 8

• AlmaLinux’s announcement says to install the listed version for your release and stream, or higher. It says php -v won’t change because the fixes are backported: “Don’t rely on php -v: our fixes are backported, so the upstream PHP version number doesn’t change.” (source: AlmaLinux)
• AlmaLinux’s errata files were too large for us to read and its errata page shows no listing (24 and October 26, 2026), so we couldn’t confirm these builds in a second AlmaLinux document.

Sources (checked October 26, 2026)

• AlmaLinux OS Foundation: PHP2Shell (CVE-2026-109618, CVE-2026-109619) announcement. Page date: Oct 21, 2026 (last changelog entry 21:15 UTC). States: Per-release, per-stream build list; ‘Install the version listed for your release and stream, or higher’; verify with rpm -q php-common, not php -v.

Upstream facts (fixed releases, CVE-2026-115560, end-of-life dates) are footnoted to /sources. We list a build as confirmed only when two different primary documents state it. Method.

Related

Red Hat Enterprise Linux 8 · Rocky Linux 8 · AlmaLinux 9 · All platforms · How to prove your server is patched · What to ask your host or developer

Want it checked for you?

• Patch Verification & Compromise Review. Collection is read-only, and we change nothing on your server. You get a plain-English report: where each fix stands, as of a stated time, plus a compromise review from October 17, signed by the Approver of Record. Ask for it
• Check it yourself, free. The read-only steps are on our PHP2Shell page. Our open-source self-check script is publishing soon.