Is PHP2Shell fixed on Rocky Linux 9?

Status as of October 26, 2026: Reported by Rocky Linux; not confirmed in a second primary source as of October 26, 2026.

The short answer

Stated in one source only, so not confirmed as of October 26, 2026: php (non-module package, PHP 8.0): php-8.0.30-8.el9_8.1; php:8.2 module stream: php-8.2.35-1.module+el9.8.0+40395+2f706e64; php:8.3 module stream: php-8.3.36-1.module+el9.8.0+40396+4e680bb7. A fixed package only counts once it’s installed and PHP has restarted (source: AlmaLinux). A related flaw, CVE-2026-115560, has no fix in any PHP release as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).

Fix status on Rocky Linux 9

How to check on Rocky Linux 9 (read-only)

Run these on the server. They only read package data and configuration files; none of them change anything. Red Hat’s bulletin adds that you should confirm the running values with a temporary phpinfo() page (delete it straight afterwards), rather than php -i, which reads only the command-line configuration.

# 1. Enabled PHP module stream (-C reads the local cache, no network)
dnf -C module list --enabled php

# 2. Installed PHP packages and their versions
rpm -qa 'php*' --qf '%{NAME} %{VERSION}-%{RELEASE}\n' | sort

# 3. Does the changelog name both CVEs?
rpm -q --changelog php-common | grep -E 'CVE-2026-1096(18|19)'

# 4. When was it updated, and has PHP restarted since?
rpm -q --last php-common
systemctl show php-fpm -p ActiveEnterTimestamp
httpd -M 2>/dev/null | grep -E 'mpm_|php'   # is Apache running PHP as a module (mod_php)?

# 5. CVE-2026-115560: is the setting in the configuration files?
grep -rns 'session.upload_progress.enabled' /etc/php* /etc/php-fpm* 2>/dev/null

Check the PHP that serves your website, not just the command line: they can be different builds (source: AlmaLinux). The five checks that count as proof.

CVE-2026-115560

On October 23, 2026, PHP disclosed a related flaw, CVE-2026-115560, that the October 21 releases don’t fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. Setting it from application code (ini_set()) or a per-directory .user.ini file doesn’t count (source: php.net advisory on CVE-2026-115560, October 23, 2026).

On Rocky Linux 9: We found no Rocky Linux statement on CVE-2026-115560 as of October 26, 2026. Red Hat’s mitigation guidance for RHEL 9 applies to the same packages: see the RHEL 9 page.

Notes for Rocky Linux 9

• These match Red Hat’s RHEL 9 fixes (RHSA-2026:87151, RHSA-2026:87072 and RHSA-2026:87079) by number and version: see the RHEL 9 page. Rocky’s own build tags differ from Red Hat’s.
• Rocky’s errata list no fix for the php:8.4 stream; Red Hat lists none for RHEL 9 either.
• The non-module PHP 8.0 build still reports 8.0.30: PHP 8.0 got no official fixed release (source: Beazley Security Labs). The version number can’t prove a patch (source: AlmaLinux).
• Rocky’s individual advisory pages showed only a page shell for us, so its errata API is the one Rocky document we could read. That’s why these rows aren’t confirmed in a second source.
• Rocky’s news page had no PHP2Shell item as of October 26, 2026.

Sources (checked October 26, 2026)

• Rocky Linux (errata API): Advisories listing CVE-2026-109618. Page date: RLSA entries published Oct 22, 2026; listing last updated Oct 26, 2026 03:40 UTC. States: 7 advisories, each listing both CVEs: RLSA-2026:87073 (Rocky 8 php:8.2), RLSA-2026:87080 (Rocky 8 php:7.4), RLSA-2026:87151, 87072, 87079 (Rocky 9 php, php:8.2, php:8.3), RLSA-2026:87070 and 87071 (Rocky 10 php, php8.4). The individual RLSA pages render only a page shell.

Upstream facts (fixed releases, CVE-2026-115560, end-of-life dates) are footnoted to /sources. We list a build as confirmed only when two different primary documents state it. Method.

Related

Red Hat Enterprise Linux 9 · AlmaLinux 9 · Rocky Linux 8 · All platforms · How to prove your server is patched · What to ask your host or developer

Want it checked for you?

• Patch Verification & Compromise Review. Collection is read-only, and we change nothing on your server. You get a plain-English report: where each fix stands, as of a stated time, plus a compromise review from October 17, signed by the Approver of Record. Ask for it
• Check it yourself, free. The read-only steps are on our PHP2Shell page. Our open-source self-check script is publishing soon.