Is PHP2Shell fixed on Debian 13 (trixie)?

Status as of October 26, 2026: Fixed packages available (each confirmed in two primary sources).

The short answer

Debian 13 (trixie) ships fixed PHP packages for PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Confirmed in two primary sources: php8.4 (trixie): 8.4.27-1~deb13u1 (DSA-6574-1). A fixed package only counts once it’s installed and PHP has restarted (source: AlmaLinux). A related flaw, CVE-2026-115560, has no fix in any PHP release as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).

Fix status on Debian 13

How to check on Debian 13 (read-only)

Run these on the server. They only read package data, logs and configuration files; none of them change anything.

# 1. Installed PHP 8.4 packages and their versions
dpkg-query -W -f='${Package} ${Version}\n' 'php8.4*' 'libapache2-mod-php8.4' 2>/dev/null

# 2. Is the installed build at or above 8.4.27-1~deb13u1?
v=$(dpkg-query -W -f='${Version}' php8.4-common)
dpkg --compare-versions "$v" ge '8.4.27-1~deb13u1' && echo "$v: at or above 8.4.27-1~deb13u1" || echo "$v: below 8.4.27-1~deb13u1"

# 3. Does the package changelog name both CVEs?
zgrep -E 'CVE-2026-1096(18|19)' /usr/share/doc/php8.4-common/changelog.Debian.gz

# 4. When was it updated, and has PHP restarted since?
zgrep -h -E ' (install|upgrade) php8.4-common' /var/log/dpkg.log* | sort | tail -n 2
systemctl show php8.4-fpm -p ActiveEnterTimestamp
systemctl show apache2 -p ActiveEnterTimestamp   # only if Apache runs PHP (mod_php)

# 5. CVE-2026-115560: is the setting in the configuration files?
grep -rn 'session.upload_progress.enabled' /etc/php/8.4/

Check the PHP that serves your website, not just the command line: they can be different builds (source: AlmaLinux). The five checks that count as proof.

CVE-2026-115560

On October 23, 2026, PHP disclosed a related flaw, CVE-2026-115560, that the October 21 releases don’t fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. Setting it from application code (ini_set()) or a per-directory .user.ini file doesn’t count (source: php.net advisory on CVE-2026-115560, October 23, 2026).

On Debian 13: Debian’s tracker had no CVE-2026-115560 entry as of October 26, 2026 (the URL returned 404), and neither advisory mentions it. (Debian Security)

Notes for Debian 13

• The upstream part of the version matches PHP’s fixed release, 8.4.27 (source: php.net release archive). The ~deb13u1 suffix marks Debian’s security build.
• PHP 8.4 receives security fixes until December 31, 2028 (source: php.net supported versions).
• Packages from a third-party repository aren’t covered by Debian’s advisory. Check where your PHP came from (apt-cache policy php8.4-common).

Sources (checked October 26, 2026)

• Debian security tracker: CVE-2026-109618. Page date: not shown. States: bookworm php8.2 fixed in 8.2.35-1deb12u1 (DLA-4848-1); trixie php8.4 fixed in 8.4.27-1deb13u1 (DSA-6574-1).
• Debian security tracker: CVE-2026-109619. Page date: not shown. States: Same fixed versions and advisories as CVE-2026-109618.
• Debian security tracker: DSA-6574-1 (php8.4). Page date: not shown. States: php8.4 trixie fixed in 8.4.27-1~deb13u1; references both CVEs.
• Debian Security (debian-security-announce): [DSA 6574-1] php8.4 security update. Page date: Oct 21, 2026. States: For the stable distribution (trixie), fixed in version 8.4.27-1~deb13u1.

Upstream facts (fixed releases, CVE-2026-115560, end-of-life dates) are footnoted to /sources. We list a build as confirmed only when two different primary documents state it. Method.

Related

Debian 12 (bookworm) · Docker Official Images: php · All platforms · How to prove your server is patched · What to ask your host or developer

Want it checked for you?

• Patch Verification & Compromise Review. Collection is read-only, and we change nothing on your server. You get a plain-English report: where each fix stands, as of a stated time, plus a compromise review from October 17, signed by the Approver of Record. Ask for it
• Check it yourself, free. The read-only steps are on our PHP2Shell page. Our open-source self-check script is publishing soon.