Status as of October 26, 2026: Fixed packages available (each confirmed in two primary sources).
The short answer
Debian 12 (bookworm) ships fixed PHP packages for PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Confirmed in two primary sources: php8.2 (bookworm): 8.2.35-1~deb12u1 (DLA-4848-1). A fixed package only counts once it’s installed and PHP has restarted (source: AlmaLinux). A related flaw, CVE-2026-115560, has no fix in any PHP release as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).
Fix status on Debian 12
| What | Fixed build or status | Advisory | Confirmed? | Sources |
|---|---|---|---|---|
| php8.2 (bookworm) | 8.2.35-1~deb12u1. A Debian LTS advisory. | DLA-4848-1 | Yes: two primary sources | Debian security tracker: CVE-2026-109618, Debian security tracker: CVE-2026-109619, Debian security tracker: DLA-4848-1 (php8.2), Debian LTS: [DLA 4848-1] php8.2 security update |
How to check on Debian 12 (read-only)
Run these on the server. They only read package data, logs and configuration files; none of them change anything.
# 1. Installed PHP 8.2 packages and their versions
dpkg-query -W -f='${Package} ${Version}\n' 'php8.2*' 'libapache2-mod-php8.2' 2>/dev/null
# 2. Is the installed build at or above 8.2.35-1~deb12u1?
v=$(dpkg-query -W -f='${Version}' php8.2-common)
dpkg --compare-versions "$v" ge '8.2.35-1~deb12u1' && echo "$v: at or above 8.2.35-1~deb12u1" || echo "$v: below 8.2.35-1~deb12u1"
# 3. Does the package changelog name both CVEs?
zgrep -E 'CVE-2026-1096(18|19)' /usr/share/doc/php8.2-common/changelog.Debian.gz
# 4. When was it updated, and has PHP restarted since?
zgrep -h -E ' (install|upgrade) php8.2-common' /var/log/dpkg.log* | sort | tail -n 2
systemctl show php8.2-fpm -p ActiveEnterTimestamp
systemctl show apache2 -p ActiveEnterTimestamp # only if Apache runs PHP (mod_php)
# 5. CVE-2026-115560: is the setting in the configuration files?
grep -rn 'session.upload_progress.enabled' /etc/php/8.2/
Check the PHP that serves your website, not just the command line: they can be different builds (source: AlmaLinux). The five checks that count as proof.
CVE-2026-115560
On October 23, 2026, PHP disclosed a related flaw, CVE-2026-115560, that the October 21 releases don’t fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. Setting it from application code (ini_set()) or a per-directory .user.ini file doesn’t count (source: php.net advisory on CVE-2026-115560, October 23, 2026).
On Debian 12: Debian’s tracker had no CVE-2026-115560 entry as of October 26, 2026 (the URL returned 404), and neither advisory mentions it. (Debian LTS)
Notes for Debian 12
- Here the upstream part of the version does match PHP’s fixed release, 8.2.35 (source: php.net release archive). The
~deb12u1suffix marks Debian’s security build. - PHP 8.2 stops receiving security fixes on December 31, 2026 (source: php.net supported versions). Plan the move to PHP 8.4 or 8.5 (source: php.net supported versions).
- Packages from a third-party repository aren’t covered by Debian’s advisory. Check where your PHP came from (
apt-cache policy php8.2-common).
Sources (checked October 26, 2026)
- Debian security tracker: CVE-2026-109618. Page date: not shown. States: bookworm php8.2 fixed in 8.2.35-1
deb12u1 (DLA-4848-1); trixie php8.4 fixed in 8.4.27-1deb13u1 (DSA-6574-1). - Debian security tracker: CVE-2026-109619. Page date: not shown. States: Same fixed versions and advisories as CVE-2026-109618.
- Debian security tracker: DLA-4848-1 (php8.2). Page date: not shown. States: php8.2 bookworm fixed in 8.2.35-1~deb12u1; references both CVEs.
- Debian LTS (debian-lts-announce): [DLA 4848-1] php8.2 security update. Page date: Oct 21, 2026. States: For Debian 12 bookworm, fixed in version 8.2.35-1~deb12u1; CVE-2026-109618, CVE-2026-109619.
Upstream facts (fixed releases, CVE-2026-115560, end-of-life dates) are footnoted to /sources. We list a build as confirmed only when two different primary documents state it. Method.
Related
Debian 13 (trixie) · Ubuntu 24.04 LTS · All platforms · How to prove your server is patched · What to ask your host or developer
Want it checked for you?
- Patch Verification & Compromise Review. Collection is read-only, and we change nothing on your server. You get a plain-English report: where each fix stands, as of a stated time, plus a compromise review from October 17, signed by the Approver of Record. Ask for it
- Check it yourself, free. The read-only steps are on our PHP2Shell page. Our open-source self-check script is publishing soon.