Is PHP2Shell fixed on CloudLinux alt-php?

Status as of October 26, 2026: Partly confirmed: some builds are confirmed in two primary sources, others aren’t yet.

The short answer

CloudLinux alt-php ships fixed PHP packages for PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Confirmed in two primary sources: alt-php 5.2–5.6, 7.0–7.4, 8.0–8.5 on CloudLinux 7, 8 and 9: Fixed builds in the stable channel (branch level) (CloudLinux advisory; TuxCare post). Stated in one source only, so not confirmed as of October 26, 2026: PHP.net-numbered alt-php builds: alt-php82 8.2.35-1, alt-php83 8.3.36-1, alt-php84 8.4.27-1, alt-php85 8.5.12-1; CloudLinux 10: alt-php only from the ELS ALT PHP repository (repo.alt.tuxcare.com); keep it enabled; CloudLinux OS for Ubuntu 22.04: alt-php 5.2, 5.6, 7.0–7.4, 8.0–8.5 in stable. A fixed package only counts once it’s installed and PHP has restarted (source: AlmaLinux). A related flaw, CVE-2026-115560, has no fix in any PHP release as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).

Fix status on CloudLinux alt-php

• CloudLinux 6: not confirmed. CloudLinux’s own page says “not confirmed yet” in one place and lists builds in another.

How to check on CloudLinux alt-php (read-only)

Run these on the server. They only read package data, the process list and configuration files.

# 1. Installed alt-php packages and their versions
rpm -qa 'alt-php*' --qf '%{NAME} %{VERSION}-%{RELEASE}\n' | sort

# 2. Does the changelog name both CVEs? (CloudLinux's own check.) Replace XY with each version you use, e.g. 85 for PHP 8.5
rpm -q --changelog alt-phpXY-common | grep -E 'CVE-2026-(109618|109619)'
# No match doesn't mean unpatched: compare the installed version with the fixed build above

# 3. When did each PHP-FPM master start? (TuxCare's check: it must be after the update)
ps -eo pid,lstart,args | grep '[p]hp-fpm: master'

# 4. CVE-2026-115560: is the setting in the configuration files? (repeat for each version, XY as above)
grep -rns 'session.upload_progress.enabled' /opt/alt/phpXY/etc/

Check the PHP that serves your website, not just the command line: they can be different builds (source: AlmaLinux). The five checks that count as proof.

CVE-2026-115560

On October 23, 2026, PHP disclosed a related flaw, CVE-2026-115560, that the October 21 releases don’t fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. Setting it from application code (ini_set()) or a per-directory .user.ini file doesn’t count (source: php.net advisory on CVE-2026-115560, October 23, 2026).

On CloudLinux alt-php: CloudLinux and TuxCare both give session.upload_progress.enabled=0 (in php.ini or the PHP-FPM pool, then restart workers) as an interim setting, and say not to rely on ini_set() or .user.ini. Neither page names CVE-2026-115560. (CloudLinux, TuxCare)

Notes for CloudLinux alt-php

• CloudLinux’s earlier backport builds keep lower version numbers; since October 23 its alt-php82–85 and ea-php82–85 builds carry PHP’s own numbers. Check the package changelog for the CVE IDs, not the version (source: AlmaLinux).
• On October 23 (21:36 UTC) CloudLinux corrected its earlier advice to disable the ELS ALT PHP repository after updating: keep it enabled. CloudLinux says that repository is becoming the single source of alt-php; CloudLinux OS 10 already gets alt-php only from it, and 7, 8 and 9 will follow. The page’s main text still shows the older advice.
• CloudLinux says the security metadata (OVAL/UpdateInfo) wasn’t published yet, so security-only update filters won’t list these packages. Use a regular update.
• CloudLinux describes its Imunify360 firewall rules as a mitigation, “not a fix”. Firewalls buy time but don’t replace the patch (source: Beazley Security Labs).

Sources (checked October 26, 2026)

• CloudLinux: PHP CVE-2026-109618 and CVE-2026-109619. Page date: Oct 21, 2026; main text updated Oct 23, 2026 08:40 UTC; status entries to Oct 23, 2026 21:36 UTC. States: ea-php52 to ea-php85 and alt-php fixed builds in stable; ea-php82–85 and alt-php82–85 on PHP.net numbers (Oct 23 13:10); earlier backports keep lower version numbers; verify with rpm -q –changelog | grep the CVE IDs; security metadata not yet published, use a regular update; session.upload_progress.enabled=0 interim setting. Oct 23 21:36 UTC correction: keep the ELS ALT PHP repository (repo.alt.tuxcare.com) enabled; it is becoming the single source of alt-php; CloudLinux OS 10 already gets alt-php only from it, 7, 8 and 9 will follow. The main text still has the older advice.
• TuxCare: PHP2Shell CVE. Page date: Oct 21, 2026; modified Oct 23, 2026. States: Fixed builds in the ELS for Runtimes repositories, incl. alt-php; update with yum/apt for alt-php*; restart every PHP worker; scanners comparing version strings may flag patched hosts.

Upstream facts (fixed releases, CVE-2026-115560, end-of-life dates) are footnoted to /sources. We list a build as confirmed only when two different primary documents state it. Method.

Related

cPanel EasyApache 4 (ea-php) · Plesk (Linux) · All platforms · How to prove your server is patched · What to ask your host or developer

Want it checked for you?

• Patch Verification & Compromise Review. Collection is read-only, and we change nothing on your server. You get a plain-English report: where each fix stands, as of a stated time, plus a compromise review from October 17, signed by the Approver of Record. Ask for it
• Check it yourself, free. The read-only steps are on our PHP2Shell page. Our open-source self-check script is publishing soon.