Am I affected?Check, then fix.
Pick your software. See the official fixed versions, then check yours.
Pick your software
php2shell
If your PHP is a build from the project itself and is older than the fixed release for its branch, update it.
Installed with apt, dnf or apk? Use the Linux packages and images table below.
Two critical PHP flaws can allow unauthenticated remote code execution.
Fixed releases by branchUpstream releases only. Packaged builds are in the table below.
| Branch | − Affected | + Fixed in |
|---|---|---|
| 8.5 | −below 8.5.12 | +8.5.12 |
| 8.4 | −below 8.4.27 | +8.4.27 |
| 8.3 | −below 8.3.36 | +8.3.36 |
| 8.2 | −below 8.2.35 | +8.2.35 |
Linux packages and imagesVersion strings as the vendor prints them
| Release | Package and fixed version | Status |
|---|---|---|
| 26.10 (stonking) | php8.5 → 8.5.9-0ubuntu2.1 | Fixed |
| 26.04 LTS (resolute) | php8.5 → 8.5.4-0ubuntu1.5 | Fixed |
| 24.04 LTS (noble) | php8.3 → 8.3.6-0ubuntu0.24.04.13 | Fixed |
| 22.04 LTS (jammy) | php8.1 → 8.1.2-1ubuntu2.28 | Fixed |
| 20.04 LTS (focal) | php7.4 → 7.4.3-4ubuntu2.29+esm5 | Fixed |
| 18.04 LTS (bionic) | php7.2 → 7.2.24-0ubuntu0.18.04.17+esm14 | Fixed |
| 16.04 LTS (xenial) | php7.0 → 7.0.33-0ubuntu0.16.04.16+esm22 | Fixed |
43 of 63 tracked Linux packages and images have the fix. 23 end-of-life releases have no vendor fix and are not counted.
Is your PHP affected? Full details →Check your PHP version against php2shell
Pick what you have. We compare it with the official fixed versions.
Runs in your browser. Nothing is sent.
Runs in your browser. Nothing is sent.
Runs in your browser. Nothing is sent.
We search the open events we track. If it is not there, we say so.
Where the fix has arrived for PHP, and where it has not
Counts come from the tracked records. Unknown is never counted as fixed.| Component | State | Detail |
|---|---|---|
| Supported branchesOfficial releases | Fixed | 4 of 4 branches have an official fixed release. |
| End-of-life branches8.1, 8.0, 7.4 | Needs attention | No official release. The project published a source patch only, so distributors may ship their own backport. |
| Older branchesBranches older than 7.4 | Needs attention | No official fix. Update to a supported branch. |
| Linux packages and imagesUbuntu, Debian, RHEL family, Alpine, Docker images | Partly fixed | 43 of 63 fixed. 6 have no fix yet and 14 are unconfirmed. 23 end-of-life releases are not counted and have no vendor fix. |
| Hosting providersStatements by each provider | Partly fixed | 13 of 70 report the fix applied. 28 are rolling out or planned, 21 ask customers to act or give a workaround, 8 have no statement or are unconfirmed. |
Also hot now
Status board →No other open events.
Recently updated
- PHPAmazon published a fixed php8.5 package for the Amazon Linux 2027 Preview: 8.5.12-1.amzn2027.0.1 (ALAS2027-2026-243).
- PHPHostnet says the PHP security update is rolled out on all of its systems, including older PHP versions via PHP Extended Support, and has lifted its temporary measures.
- PHPHetzner says it has also deployed patches for PHP 5.6 and 7.3 on all Webhosting and Managed Servers, after PHP 7.4 and 8.0 to 8.5.
- PHPUpsun says the PHP security patch has finished deploying to all Dedicated clusters, after updated images reached all grid regions.
- PHPCPI says it is urgently applying the latest PHP patches on the versions that have one, and will post an update on versions without a patch.Vendor announcementsource ↗
- Open events
- 0
- Packages and images fixed
- 43of 63
- Waiting for a fix
- 6
- Unconfirmed
- 14
Counts cover the Linux packages and images tracked for PHP: 43 fixed + 6 waiting + 14 unconfirmed = 63 tracked. 23 end-of-life releases have no vendor fix and are not counted. Hosting providers are counted separately.
How to read a status
Each status has a shape, a word and a border style. Colour is never the only signal.
Fixed
The record you are reading lists a fix, or the vendor says the release was never affected (“Not affected”, tagged “Vendor statement”). The scope is always named: this release, this package, this host.
Next: confirm you run that version or later.
Not fixed
Only for a value you pasted: it is below the fixed release for its branch.
Next: update, then check again.
Needs attention
No fix you can simply install, or one that depends on someone else: an end-of-life branch, a vendor still working, a workaround only.
Next: wait for the vendor, or apply the workaround.
Unconfirmed
We could not confirm it from an official source, or only one official source says so. Unknown is never shown as fixed.
Next: check the vendor's own page.
Why a lower number can be fixed
26.10 (stonking) ships php8.5 8.5.9-0ubuntu2.1. That number is lower than the upstream fixes listed above, yet 26.10 (stonking) marks it fixed, because the vendor backported the patch to its own version. Compare a package number only with the vendor's own row, never with an upstream number.
| Release | Package and fixed version | Status |
|---|---|---|
| 26.10 (stonking) | php8.5 → 8.5.9-0ubuntu2.1 | Fixed |
| 26.04 LTS (resolute) | php8.5 → 8.5.4-0ubuntu1.5 | Fixed |
| 24.04 LTS (noble) | php8.3 → 8.3.6-0ubuntu0.24.04.13 | Fixed |
A vendor row says one of three things. Fixed names the package version. No fix yet means the vendor lists the flaw but names no package. Unconfirmed means we found no official statement.
Email alerts open soon
Sign-up is not open yet. Until it is, the status board lists every open event with the time it was last checked.
Open the status boardWritten patch plan, US$49
Send us your server details. A written step-by-step plan reaches you by email within 24 hours. We never log in to your server.
See the planHow PatchBell works
Read the method →Official sources only
Every version comes from the project or vendor that ships it. A version is shown as fixed only when two independent official sources agree. With one source we still show it, marked Unconfirmed. Distro rows come from that distro's own tracker.
Last checked, on every page
Each page shows when its data was last read. Old information is never dressed up as new.
A reference, not a scanner
Checks run in your browser against data bundled with the page. Nothing is sent, and your site is never contacted.