Is PHP2Shell fixed on Ubuntu 26.10?

Status as of October 26, 2026: Fixed packages available (each confirmed in two primary sources).

The short answer

Ubuntu 26.10 ships fixed PHP packages for PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Confirmed in two primary sources: php8.5 (stonking): 8.5.9-0ubuntu2.1 (USN-8948-1). A fixed package only counts once it’s installed and PHP has restarted (source: AlmaLinux). A related flaw, CVE-2026-115560, has no fix in any PHP release as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).

Fix status on Ubuntu 26.10

How to check on Ubuntu 26.10 (read-only)

Run these on the server. They only read package data, logs and configuration files; none of them change anything.

# 1. Installed PHP 8.5 packages and their versions
dpkg-query -W -f='${Package} ${Version}\n' 'php8.5*' 'libapache2-mod-php8.5' 2>/dev/null

# 2. Is the installed build at or above 8.5.9-0ubuntu2.1?
v=$(dpkg-query -W -f='${Version}' php8.5-common)
dpkg --compare-versions "$v" ge '8.5.9-0ubuntu2.1' && echo "$v: at or above 8.5.9-0ubuntu2.1" || echo "$v: below 8.5.9-0ubuntu2.1"

# 3. Does the package changelog name both CVEs?
zgrep -E 'CVE-2026-1096(18|19)' /usr/share/doc/php8.5-common/changelog.Debian.gz

# 4. When was it updated, and has PHP restarted since?
zgrep -h -E ' (install|upgrade) php8.5-common' /var/log/dpkg.log* | sort | tail -n 2
systemctl show php8.5-fpm -p ActiveEnterTimestamp
systemctl show apache2 -p ActiveEnterTimestamp   # only if Apache runs PHP (mod_php)

# 5. CVE-2026-115560: is the setting in the configuration files?
grep -rn 'session.upload_progress.enabled' /etc/php/8.5/

Check the PHP that serves your website, not just the command line: they can be different builds (source: AlmaLinux). The five checks that count as proof.

CVE-2026-115560

On October 23, 2026, PHP disclosed a related flaw, CVE-2026-115560, that the October 21 releases don’t fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. Setting it from application code (ini_set()) or a per-directory .user.ini file doesn’t count (source: php.net advisory on CVE-2026-115560, October 23, 2026).

On Ubuntu 26.10: Ubuntu had no CVE-2026-115560 page as of October 26, 2026 (the tracker URL returned 404), and USN-8948-1 doesn’t mention it. (Canonical)

Notes for Ubuntu 26.10

• The fixed build reports 8.5.9, below PHP’s own fixed release 8.5.12 (source: php.net release archive). Ubuntu backported the fix, so the version number alone can’t tell you (source: AlmaLinux).

Sources (checked October 26, 2026)

• Canonical (Ubuntu): USN-8948-1: PHP vulnerabilities. Page date: Oct 21, 2026. States: Covers CVE-2026-109618 and CVE-2026-109619 for 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS.
• Canonical (Ubuntu CVE tracker): CVE-2026-109618. Page date: Oct 21, 2026 (published and last updated). States: Per-release ‘Fixed in’ versions; priority Critical.
• Canonical (Ubuntu CVE tracker): CVE-2026-109619. Page date: Oct 21, 2026 (published and last updated). States: Same per-release ‘Fixed in’ versions as CVE-2026-109618.

Upstream facts (fixed releases, CVE-2026-115560, end-of-life dates) are footnoted to /sources. We list a build as confirmed only when two different primary documents state it. Method.

Related

Ubuntu 26.04 LTS · Ubuntu 24.04 LTS · All platforms · How to prove your server is patched · What to ask your host or developer

Want it checked for you?

• Patch Verification & Compromise Review. Collection is read-only, and we change nothing on your server. You get a plain-English report: where each fix stands, as of a stated time, plus a compromise review from October 17, signed by the Approver of Record. Ask for it
• Check it yourself, free. The read-only steps are on our PHP2Shell page. Our open-source self-check script is publishing soon.