Is PHP2Shell fixed on Red Hat Enterprise Linux 9?

Status as of October 26, 2026: Partly confirmed: some builds are confirmed in two primary sources, others aren’t yet.

The short answer

Red Hat Enterprise Linux 9 ships fixed PHP packages for PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Confirmed in two primary sources: php (non-module package, PHP 8.0): php-8.0.30-8.el9_8.1 (RHSA-2026:87151); php:8.2 module stream: php-8.2.35-1.module+el9.8.0+25111+a1450321 (RHSA-2026:87072); php:8.3 module stream: php-8.3.36-1.module+el9.8.0+25109+6886e21a (RHSA-2026:87079); php on RHEL 9.6 EUS (PHP 8.0): php-8.0.30-3.el9_6.2 (RHSA-2026:88720 (Oct 23, 2026)); php:8.2 on RHEL 9.6 EUS: php-8.2.28-1.module+el9.6.0+25176+d8415d54.4 (RHSA-2026:88834 (Oct 23, 2026)); php on RHEL 9.4 SAP Solutions, E4S (PHP 8.0): php-8.0.30-1.el9_4.2 (RHSA-2026:88725 (Oct 23, 2026)); php:8.2 on RHEL 9.4 SAP Solutions, E4S: php-8.2.13-1.module+el9.4.0+25177+88c847cf.4 (RHSA-2026:88835 (Oct 23, 2026)); php on RHEL 9.2 SAP Solutions, E4S (PHP 8.0): php-8.0.30-1.el9_2.2 (RHSA-2026:88659 (Oct 23, 2026)). A fixed package only counts once it’s installed and PHP has restarted (source: AlmaLinux). A related flaw, CVE-2026-115560, has no fix in any PHP release as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).

Fix status on RHEL 9

• php:8.4 module stream: Red Hat’s CVE records list it as affected, with no fix listed, as of October 26, 2026.

How to check on RHEL 9 (read-only)

Run these on the server. They only read package data and configuration files; none of them change anything. Red Hat’s bulletin adds that you should confirm the running values with a temporary phpinfo() page (delete it straight afterwards), rather than php -i, which reads only the command-line configuration.

# 1. Enabled PHP module stream (-C reads the local cache, no network)
dnf -C module list --enabled php

# 2. Installed PHP packages and their versions
rpm -qa 'php*' --qf '%{NAME} %{VERSION}-%{RELEASE}\n' | sort

# 3. Does the changelog name both CVEs?
rpm -q --changelog php-common | grep -E 'CVE-2026-1096(18|19)'

# 4. When was it updated, and has PHP restarted since?
rpm -q --last php-common
systemctl show php-fpm -p ActiveEnterTimestamp
httpd -M 2>/dev/null | grep -E 'mpm_|php'   # is Apache running PHP as a module (mod_php)?

# 5. CVE-2026-115560: is the setting in the configuration files?
grep -rns 'session.upload_progress.enabled' /etc/php* /etc/php-fpm* 2>/dev/null

Check the PHP that serves your website, not just the command line: they can be different builds (source: AlmaLinux). The five checks that count as proof.

CVE-2026-115560

On October 23, 2026, PHP disclosed a related flaw, CVE-2026-115560, that the October 21 releases don’t fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. Setting it from application code (ini_set()) or a per-directory .user.ini file doesn’t count (source: php.net advisory on CVE-2026-115560, October 23, 2026).

On RHEL 9: Red Hat’s bulletin recommends session.upload_progress.enabled = 0, set with php_admin_value: it says ini_set() and PHP-FPM .user.ini files aren’t suitable. The line shipped in /etc/php.ini is commented out and the feature defaults to on, so you must add the line with the value 0, then restart: a reload isn’t enough. Red Hat says disabling session upload progress protects against CVE-2026-115560, and that upstream expects a fix in the next routine PHP release. It is still assessing product impact and had no CVE record for it as of October 26, 2026. (Red Hat)

Notes for RHEL 9

• The non-module PHP 8.0 builds still report 8.0.30: PHP 8.0 got no official fixed release (source: Beazley Security Labs). The 9.4 and 9.6 php:8.2 builds report 8.2.13 and 8.2.28, older than PHP’s fixed 8.2.35 (source: php.net release archive). Red Hat backported the fix in each case (source: AlmaLinux).
• If you run the php:8.4 stream, check Red Hat’s CVE pages for a fix before assuming one exists. Meanwhile, apply the configuration mitigations in Red Hat’s bulletin, and consider the php:8.3 stream until a fix ships.

Sources (checked October 26, 2026)

• Red Hat: RHSA-2026:87151 (php, RHEL 9). Page date: issued Oct 21, 2026. States: php-8.0.30-8.el9_8.1 (no module stream); fixes both CVEs.
• Red Hat (CVE record, data API): CVE-2026-109618. Page date: public Oct 21, 2026. States: affected_release entries per product and stream, with RHSA IDs; RHEL 9 php:8.4 listed as Affected.
• Red Hat (CVE record, data API): CVE-2026-109619. Page date: public Oct 21, 2026. States: Same entries as CVE-2026-109618, plus RHEL 7 ELS (RHSA-2026:88693).
• Red Hat: RHSA-2026:87072 (php:8.2, RHEL 9). Page date: issued Oct 21, 2026. States: php-8.2.35-1.module+el9.8.0+25111+a1450321; fixes both CVEs.
• Red Hat: RHSA-2026:87079 (php:8.3, RHEL 9). Page date: issued Oct 21, 2026. States: php-8.3.36-1.module+el9.8.0+25109+6886e21a; fixes both CVEs.
• Red Hat: RHSA-2026:88720 (php, RHEL 9.6 EUS). Page date: issued Oct 23, 2026. States: RHEL 9.6 Extended Update Support; php-8.0.30-3.el9_6.2; fixes CVE-2026-109618 and CVE-2026-109619.
• Red Hat: RHSA-2026:88834 (php:8.2, RHEL 9.6 EUS). Page date: issued Oct 23, 2026. States: RHEL 9.6 Extended Update Support; php-8.2.28-1.module+el9.6.0+25176+d8415d54.4; fixes CVE-2026-109618 and CVE-2026-109619.
• Red Hat: RHSA-2026:88725 (php, RHEL 9.4 E4S). Page date: issued Oct 23, 2026. States: RHEL 9.4 Update Services for SAP Solutions; php-8.0.30-1.el9_4.2; fixes CVE-2026-109618 and CVE-2026-109619.
• Red Hat: RHSA-2026:88835 (php:8.2, RHEL 9.4 E4S). Page date: issued Oct 23, 2026. States: RHEL 9.4 Update Services for SAP Solutions; php-8.2.13-1.module+el9.4.0+25177+88c847cf.4; fixes CVE-2026-109618 and CVE-2026-109619.
• Red Hat: RHSA-2026:88659 (php, RHEL 9.2 E4S). Page date: issued Oct 23, 2026. States: RHEL 9.2 Update Services for SAP Solutions; php-8.0.30-1.el9_2.2; fixes CVE-2026-109618 and CVE-2026-109619.
• Red Hat: RHSB-2026-013 security bulletin. Page date: public Oct 21, 2026; updated Oct 23, 2026 13:15. States: RHEL 8, 9, 10 affected (RHEL 7 for CVE-2026-109619 only); session.upload_progress.enabled = 0, added (the shipped line is commented out) and set with php_admin_value, not ini_set() or .user.ini; restart, a reload is not enough; verify with a temporary phpinfo() page rather than php -i; says disabling session upload progress protects against CVE-2026-115560 and upstream expects its fix in the next routine release; Red Hat is assessing CVE-2026-115560’s product impact.

Upstream facts (fixed releases, CVE-2026-115560, end-of-life dates) are footnoted to /sources. We list a build as confirmed only when two different primary documents state it. Method.

Related

AlmaLinux 9 · Rocky Linux 9 · Red Hat Enterprise Linux 10 · All platforms · How to prove your server is patched · What to ask your host or developer

Want it checked for you?

• Patch Verification & Compromise Review. Collection is read-only, and we change nothing on your server. You get a plain-English report: where each fix stands, as of a stated time, plus a compromise review from October 17, signed by the Approver of Record. Ask for it
• Check it yourself, free. The read-only steps are on our PHP2Shell page. Our open-source self-check script is publishing soon.