Is PHP2Shell fixed on Ubuntu 20.04 LTS?

Status as of October 26, 2026: Fixed packages available (each confirmed in two primary sources).

The short answer

Ubuntu 20.04 LTS ships fixed PHP packages for PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Confirmed in two primary sources: php7.4 (focal): 7.4.3-4ubuntu2.29+esm5 (USN-8948-2). A fixed package only counts once it’s installed and PHP has restarted (source: AlmaLinux). A related flaw, CVE-2026-115560, has no fix in any PHP release as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).

Fix status on Ubuntu 20.04

How to check on Ubuntu 20.04 (read-only)

Run these on the server. They only read package data, logs and configuration files; none of them change anything.

# 0. Is Ubuntu Pro attached? The fix ships through Ubuntu Pro (ESM)
pro status

# 1. Installed PHP 7.4 packages and their versions
dpkg-query -W -f='${Package} ${Version}\n' 'php7.4*' 'libapache2-mod-php7.4' 2>/dev/null

# 2. Is the installed build at or above 7.4.3-4ubuntu2.29+esm5?
v=$(dpkg-query -W -f='${Version}' php7.4-common)
dpkg --compare-versions "$v" ge '7.4.3-4ubuntu2.29+esm5' && echo "$v: at or above 7.4.3-4ubuntu2.29+esm5" || echo "$v: below 7.4.3-4ubuntu2.29+esm5"

# 3. Does the package changelog name both CVEs?
zgrep -E 'CVE-2026-1096(18|19)' /usr/share/doc/php7.4-common/changelog.Debian.gz

# 4. When was it updated, and has PHP restarted since?
zgrep -h -E ' (install|upgrade) php7.4-common' /var/log/dpkg.log* | sort | tail -n 2
systemctl show php7.4-fpm -p ActiveEnterTimestamp
systemctl show apache2 -p ActiveEnterTimestamp   # only if Apache runs PHP (mod_php)

# 5. CVE-2026-115560: is the setting in the configuration files?
grep -rn 'session.upload_progress.enabled' /etc/php/7.4/

Check the PHP that serves your website, not just the command line: they can be different builds (source: AlmaLinux). The five checks that count as proof.

CVE-2026-115560

On October 23, 2026, PHP disclosed a related flaw, CVE-2026-115560, that the October 21 releases don’t fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. Setting it from application code (ini_set()) or a per-directory .user.ini file doesn’t count (source: php.net advisory on CVE-2026-115560, October 23, 2026).

On Ubuntu 20.04: Ubuntu had no CVE-2026-115560 page as of October 26, 2026 (the tracker URL returned 404), and neither USN mentions it. (Canonical)

Notes for Ubuntu 20.04

• The fix comes through Ubuntu Pro. If Ubuntu Pro isn’t attached to the machine, the fixed package isn’t available to it. pro status (read-only) shows whether it is.
• The version string still starts 7.4.3: Ubuntu backported the fix without changing the upstream version, which is why a version number can’t prove a patch (source: AlmaLinux).
• PHP 7.4 stopped receiving official security fixes in November 2022 (source: php.net unsupported branches). The Ubuntu Pro package is a bridge. Plan the move to PHP 8.4 or 8.5 (source: php.net supported versions).

Sources (checked October 26, 2026)

• Canonical (Ubuntu): USN-8948-2: PHP vulnerabilities. Page date: Oct 21, 2026. States: Covers both CVEs for 20.04, 18.04, 16.04 and 14.04 (Ubuntu Pro).
• Canonical (Ubuntu CVE tracker): CVE-2026-109618. Page date: Oct 21, 2026 (published and last updated). States: Per-release ‘Fixed in’ versions; priority Critical.
• Canonical (Ubuntu CVE tracker): CVE-2026-109619. Page date: Oct 21, 2026 (published and last updated). States: Same per-release ‘Fixed in’ versions as CVE-2026-109618.

Upstream facts (fixed releases, CVE-2026-115560, end-of-life dates) are footnoted to /sources. We list a build as confirmed only when two different primary documents state it. Method.

Related

Ubuntu 22.04 LTS · Ubuntu 24.04 LTS · All platforms · How to prove your server is patched · What to ask your host or developer

Want it checked for you?

• Patch Verification & Compromise Review. Collection is read-only, and we change nothing on your server. You get a plain-English report: where each fix stands, as of a stated time, plus a compromise review from October 17, signed by the Approver of Record. Ask for it
• Check it yourself, free. The read-only steps are on our PHP2Shell page. Our open-source self-check script is publishing soon.