Is PHP2Shell fixed on Red Hat Enterprise Linux 10?

Status as of October 26, 2026: Fixed packages available (each confirmed in two primary sources).

The short answer

Red Hat Enterprise Linux 10 ships fixed PHP packages for PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Confirmed in two primary sources: php (PHP 8.3): php-8.3.36-1.el10_2 (RHSA-2026:87070); php8.4: php8.4-8.4.27-1.el10_2 (RHSA-2026:87071); RHEL 10.0 EUS (php, PHP 8.3): php-8.3.19-1.el10_0.2 (RHSA-2026:88561 (Oct 23, 2026)). A fixed package only counts once it’s installed and PHP has restarted (source: AlmaLinux). A related flaw, CVE-2026-115560, has no fix in any PHP release as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).

Fix status on RHEL 10

How to check on RHEL 10 (read-only)

Run these on the server. They only read package data and configuration files; none of them change anything. Red Hat’s bulletin adds that you should confirm the running values with a temporary phpinfo() page (delete it straight afterwards), rather than php -i, which reads only the command-line configuration.

# 2. Installed PHP packages and their versions
rpm -qa 'php*' --qf '%{NAME} %{VERSION}-%{RELEASE}\n' | sort

# 3. Does the changelog name both CVEs?
rpm -q --changelog php-common | grep -E 'CVE-2026-1096(18|19)'
rpm -q --changelog php8.4-common | grep -E 'CVE-2026-1096(18|19)'   # if you use php8.4

# 4. When was it updated, and has PHP restarted since?
rpm -q --last php-common
systemctl show php-fpm -p ActiveEnterTimestamp
httpd -M 2>/dev/null | grep -E 'mpm_|php'   # is Apache running PHP as a module (mod_php)?

# 5. CVE-2026-115560: is the setting in the configuration files?
grep -rns 'session.upload_progress.enabled' /etc/php* /etc/php-fpm* 2>/dev/null

Check the PHP that serves your website, not just the command line: they can be different builds (source: AlmaLinux). The five checks that count as proof.

CVE-2026-115560

On October 23, 2026, PHP disclosed a related flaw, CVE-2026-115560, that the October 21 releases don’t fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. Setting it from application code (ini_set()) or a per-directory .user.ini file doesn’t count (source: php.net advisory on CVE-2026-115560, October 23, 2026).

On RHEL 10: Red Hat’s bulletin recommends session.upload_progress.enabled = 0, set with php_admin_value: it says ini_set() and PHP-FPM .user.ini files aren’t suitable. The line shipped in /etc/php.ini is commented out and the feature defaults to on, so you must add the line with the value 0, then restart: a reload isn’t enough. Red Hat says disabling session upload progress protects against CVE-2026-115560, and that upstream expects a fix in the next routine PHP release. It is still assessing product impact and had no CVE record for it as of October 26, 2026. (Red Hat)

Notes for RHEL 10

• On RHEL 10.2 the upstream versions match PHP’s fixed releases (8.3.36 and 8.4.27) (source: php.net release archive). The 10.0 EUS build reports 8.3.19 because the fix is a backport (source: AlmaLinux).

Sources (checked October 26, 2026)

• Red Hat: RHSA-2026:87070 (php, RHEL 10). Page date: issued Oct 21, 2026. States: php-8.3.36-1.el10_2; fixes CVE-2026-109618, CVE-2026-109619.
• Red Hat (CVE record, data API): CVE-2026-109618. Page date: public Oct 21, 2026. States: affected_release entries per product and stream, with RHSA IDs; RHEL 9 php:8.4 listed as Affected.
• Red Hat (CVE record, data API): CVE-2026-109619. Page date: public Oct 21, 2026. States: Same entries as CVE-2026-109618, plus RHEL 7 ELS (RHSA-2026:88693).
• Red Hat: RHSA-2026:87071 (php8.4, RHEL 10). Page date: issued Oct 21, 2026. States: php8.4-8.4.27-1.el10_2; fixes both CVEs.
• Red Hat: RHSA-2026:88561 (php, RHEL 10.0 EUS). Page date: issued Oct 23, 2026. States: RHEL 10.0 Extended Update Support; php-8.3.19-1.el10_0.2; fixes CVE-2026-109618 and CVE-2026-109619.
• Red Hat: RHSB-2026-013 security bulletin. Page date: public Oct 21, 2026; updated Oct 23, 2026 13:15. States: RHEL 8, 9, 10 affected (RHEL 7 for CVE-2026-109619 only); session.upload_progress.enabled = 0, added (the shipped line is commented out) and set with php_admin_value, not ini_set() or .user.ini; restart, a reload is not enough; verify with a temporary phpinfo() page rather than php -i; says disabling session upload progress protects against CVE-2026-115560 and upstream expects its fix in the next routine release; Red Hat is assessing CVE-2026-115560’s product impact.

Upstream facts (fixed releases, CVE-2026-115560, end-of-life dates) are footnoted to /sources. We list a build as confirmed only when two different primary documents state it. Method.

Related

AlmaLinux 10 · Rocky Linux 10 · Red Hat Enterprise Linux 9 · All platforms · How to prove your server is patched · What to ask your host or developer

Want it checked for you?

• Patch Verification & Compromise Review. Collection is read-only, and we change nothing on your server. You get a plain-English report: where each fix stands, as of a stated time, plus a compromise review from October 17, signed by the Approver of Record. Ask for it
• Check it yourself, free. The read-only steps are on our PHP2Shell page. Our open-source self-check script is publishing soon.