Is PHP2Shell fixed on Red Hat Enterprise Linux 8?

Status as of October 26, 2026: Partly confirmed: some builds are confirmed in two primary sources, others aren’t yet.

The short answer

Red Hat Enterprise Linux 8 ships fixed PHP packages for PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Confirmed in two primary sources: php:8.2 module stream: php-8.2.35-1.module+el8.10.0+25110+f67151d2 (RHSA-2026:87073); php:7.4 module stream: php-7.4.33-8.module+el8.10.0+25117+30337cca (RHSA-2026:87080); php:7.4 on RHEL 8.4 AUS and EUS Long-Life: php-7.4.6-5.module+el8.4.0+25156+e0c98721.3 (RHSA-2026:88565 (Oct 23, 2026)); php:7.4 on RHEL 8.6 AUS and EUS Long-Life: php-7.4.19-4.module+el8.6.0+25157+c2ff122e.3 (RHSA-2026:88533 (Oct 23, 2026)); php:7.4 on RHEL 8.8 TUS and SAP Solutions: php-7.4.33-1.module+el8.8.0+25148+55cf9df9.2 (RHSA-2026:88532 (Oct 23, 2026)). A fixed package only counts once it’s installed and PHP has restarted (source: AlmaLinux). A related flaw, CVE-2026-115560, has no fix in any PHP release as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).

Fix status on RHEL 8

• Red Hat’s records list no fix for RHEL 8’s other PHP module streams as of October 26, 2026.

How to check on RHEL 8 (read-only)

Run these on the server. They only read package data and configuration files; none of them change anything. Red Hat’s bulletin adds that you should confirm the running values with a temporary phpinfo() page (delete it straight afterwards), rather than php -i, which reads only the command-line configuration.

# 1. Enabled PHP module stream (-C reads the local cache, no network)
dnf -C module list --enabled php

# 2. Installed PHP packages and their versions
rpm -qa 'php*' --qf '%{NAME} %{VERSION}-%{RELEASE}\n' | sort

# 3. Does the changelog name both CVEs?
rpm -q --changelog php-common | grep -E 'CVE-2026-1096(18|19)'

# 4. When was it updated, and has PHP restarted since?
rpm -q --last php-common
systemctl show php-fpm -p ActiveEnterTimestamp
httpd -M 2>/dev/null | grep -E 'mpm_|php'   # is Apache running PHP as a module (mod_php)?

# 5. CVE-2026-115560: is the setting in the configuration files?
grep -rns 'session.upload_progress.enabled' /etc/php* /etc/php-fpm* 2>/dev/null

Check the PHP that serves your website, not just the command line: they can be different builds (source: AlmaLinux). The five checks that count as proof.

CVE-2026-115560

On October 23, 2026, PHP disclosed a related flaw, CVE-2026-115560, that the October 21 releases don’t fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. Setting it from application code (ini_set()) or a per-directory .user.ini file doesn’t count (source: php.net advisory on CVE-2026-115560, October 23, 2026).

On RHEL 8: Red Hat’s bulletin recommends session.upload_progress.enabled = 0, set with php_admin_value: it says ini_set() and PHP-FPM .user.ini files aren’t suitable. The line shipped in /etc/php.ini is commented out and the feature defaults to on, so you must add the line with the value 0, then restart: a reload isn’t enough. Red Hat says disabling session upload progress protects against CVE-2026-115560, and that upstream expects a fix in the next routine PHP release. It is still assessing product impact and had no CVE record for it as of October 26, 2026. (Red Hat)

Notes for RHEL 8

• The fixed php:7.4 builds still report 7.4.33 or older (7.4.6 and 7.4.19 on the 8.4 and 8.6 update streams), versions PHP itself never fixed: no official PHP release fixes 7.4 (source: Beazley Security Labs). Red Hat backported the fix, which is why a version number can’t prove a patch (source: AlmaLinux).
• Red Hat’s bulletin says PHP-FPM is the default on RHEL 8 and later, and that a reload isn’t enough: restart the service after updating.

Sources (checked October 26, 2026)

• Red Hat: RHSA-2026:87073 (php:8.2, RHEL 8). Page date: issued Oct 21, 2026. States: php-8.2.35-1.module+el8.10.0+25110+f67151d2; fixes both CVEs.
• Red Hat (CVE record, data API): CVE-2026-109618. Page date: public Oct 21, 2026. States: affected_release entries per product and stream, with RHSA IDs; RHEL 9 php:8.4 listed as Affected.
• Red Hat (CVE record, data API): CVE-2026-109619. Page date: public Oct 21, 2026. States: Same entries as CVE-2026-109618, plus RHEL 7 ELS (RHSA-2026:88693).
• Red Hat: RHSA-2026:87080 (php:7.4, RHEL 8). Page date: issued Oct 21, 2026. States: php-7.4.33-8.module+el8.10.0+25117+30337cca; fixes both CVEs among others.
• Red Hat: RHSA-2026:88565 (php:7.4, RHEL 8.4 AUS). Page date: issued Oct 23, 2026. States: RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On; php-7.4.6-5.module+el8.4.0+25156+e0c98721.3; fixes CVE-2026-109618 and CVE-2026-109619.
• Red Hat: RHSA-2026:88533 (php:7.4, RHEL 8.6 AUS). Page date: issued Oct 23, 2026. States: RHEL 8.6 Advanced Mission Critical Update Support and EUS Long-Life Add-On; php-7.4.19-4.module+el8.6.0+25157+c2ff122e.3; fixes CVE-2026-109618 and CVE-2026-109619.
• Red Hat: RHSA-2026:88532 (php:7.4, RHEL 8.8 TUS). Page date: issued Oct 23, 2026. States: RHEL 8.8 Telecommunications Update Service and Update Services for SAP Solutions; php-7.4.33-1.module+el8.8.0+25148+55cf9df9.2; fixes CVE-2026-109618 and CVE-2026-109619.
• Red Hat: RHSB-2026-013 security bulletin. Page date: public Oct 21, 2026; updated Oct 23, 2026 13:15. States: RHEL 8, 9, 10 affected (RHEL 7 for CVE-2026-109619 only); session.upload_progress.enabled = 0, added (the shipped line is commented out) and set with php_admin_value, not ini_set() or .user.ini; restart, a reload is not enough; verify with a temporary phpinfo() page rather than php -i; says disabling session upload progress protects against CVE-2026-115560 and upstream expects its fix in the next routine release; Red Hat is assessing CVE-2026-115560’s product impact.

Upstream facts (fixed releases, CVE-2026-115560, end-of-life dates) are footnoted to /sources. We list a build as confirmed only when two different primary documents state it. Method.

Related

AlmaLinux 8 · Rocky Linux 8 · Red Hat Enterprise Linux 9 · All platforms · How to prove your server is patched · What to ask your host or developer

Want it checked for you?

• Patch Verification & Compromise Review. Collection is read-only, and we change nothing on your server. You get a plain-English report: where each fix stands, as of a stated time, plus a compromise review from October 17, signed by the Approver of Record. Ask for it
• Check it yourself, free. The read-only steps are on our PHP2Shell page. Our open-source self-check script is publishing soon.