https://patchbell.com/php/php2shell/ Open events and the state of their fix. The same data as the event tables. en Thu, 22 Oct 2026 06:48:40 GMT https://patchbell.com/php/php2shell/ 2026-10-22 https://alas.aws.amazon.com/AL2027/ALAS2027-2026-243.html Thu, 22 Oct 2026 00:00:00 GMT Fix released: Amazon published a fixed php8.5 package for the Amazon Linux 2027 Preview: 8.5.12-1.amzn2027.0.1 (ALAS2027-2026-243). https://patchbell.com/php/php2shell/ 2026-10-22 https://hostnet.status.io/ Thu, 22 Oct 2026 00:00:00 GMT Fix released: Hostnet says the PHP security update is rolled out on all of its systems, including older PHP versions via PHP Extended Support, and has lifted its temporary measures. https://patchbell.com/php/php2shell/ 2026-10-22 https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7 Thu, 22 Oct 2026 00:00:00 GMT Fix released: Hetzner says it has also deployed patches for PHP 5.6 and 7.3 on all Webhosting and Managed Servers, after PHP 7.4 and 8.0 to 8.5. https://patchbell.com/php/php2shell/ 2026-10-22 https://status.upsun.com/ Thu, 22 Oct 2026 00:00:00 GMT Fix released: Upsun says the PHP security patch has finished deploying to all Dedicated clusters, after updated images reached all grid regions. https://patchbell.com/php/php2shell/ 2026-10-22 https://www.cpi.ad.jp/ Thu, 22 Oct 2026 00:00:00 GMT Status changed: CPI says it is urgently applying the latest PHP patches on the versions that have one, and will post an update on versions without a patch. https://patchbell.com/php/php2shell/ 2026-10-22 https://access.redhat.com/security/cve/CVE-2026-109618 Thu, 22 Oct 2026 00:00:00 GMT Status changed: Red Hat's CVE pages now list fixed packages. RHEL 10: php 8.3.36-1.el10_2 (RHSA-2026:87070) and php8.4 8.4.27-1.el10_2 (RHSA-2026:87071). RHEL 9: php 8.0.30-8.el9_8.1 (RHSA-2026:87151), php:8.2 (RHSA-2026:87072) and php:8.3 (RHSA-2026:87079). RHEL 8: php:8.2 (RHSA-2026:87073), after php:7.4 (RHSA-2026:87080). RHEL 9 php:8.4 is still listed as Affected with no advisory, and RHEL 7 as 'Under investigation' for CVE-2026-109618 and 'Not affected' for CVE-2026-109619. https://patchbell.com/php/php2shell/ 2026-10-22 https://errata.rockylinux.org/RLSA-2026:87070 Thu, 22 Oct 2026 00:00:00 GMT Fix released: Rocky Linux published fixed PHP packages. Rocky Linux 10: php 8.3.36-1.el10_2 (RLSA-2026:87070) and php8.4 8.4.27-1.el10_2 (RLSA-2026:87071). Rocky Linux 9: php 8.0.30-8.el9_8.1 (RLSA-2026:87151), php:8.2 (RLSA-2026:87072) and php:8.3 (RLSA-2026:87079). Rocky Linux 8: php:7.4 (RLSA-2026:87080). There is no advisory yet for Rocky Linux 9 php:8.4 or Rocky Linux 8 php:8.2. https://patchbell.com/php/php2shell/ 2026-10-22 https://linux.oracle.com/cve/CVE-2026-109618.html Thu, 22 Oct 2026 00:00:00 GMT Status changed: Oracle's CVE pages list errata for Oracle Linux 10 (ELSA-2026-87070 php 8.3.36-1.el10_2 and ELSA-2026-87071 php8.4 8.4.27-1.el10_2) and Oracle Linux 9 (ELSA-2026-87151 php 8.0.30-8.el9_8.1). They list no php module stream for Oracle Linux 9 and no entry yet for Oracle Linux 8. https://patchbell.com/php/php2shell/ 2026-10-22 https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3304.html Thu, 22 Oct 2026 00:00:00 GMT Fix released: Amazon Linux 2023: ALAS2023-2026-3301 to ALAS2023-2026-3304 list fixed packages for php8.2 (8.2.35-1.amzn2023.0.1), php8.3 (8.3.36-1.amzn2023.0.1), php8.4 (8.4.27-1.amzn2023.0.1) and php8.5 (8.5.12-1.amzn2023.0.1). https://patchbell.com/php/php2shell/ 2026-10-22 https://alas.aws.amazon.com/AL2/ALAS2PHP8.2-2026-015.html Thu, 22 Oct 2026 00:00:00 GMT Fix released: Amazon Linux 2: ALAS2PHP8.2-2026-015 lists the fixed php 8.2.35-1.amzn2.0.1 packages for the amazon-linux-extras php8.2 stream. https://patchbell.com/php/php2shell/ 2026-10-22 https://explore.alas.aws.amazon.com/CVE-2026-109618.html Thu, 22 Oct 2026 00:00:00 GMT Status changed: Amazon's CVE pages list php8.1 on Amazon Linux 2023 and the Amazon Linux 2 core php package as 'No Fix Planned'; no fixed package is shown for either. https://patchbell.com/php/php2shell/ 2026-10-22 https://secdb.alpinelinux.org/edge/community.json Thu, 22 Oct 2026 00:00:00 GMT Fix released: Alpine edge: php83 8.3.36-r0, php84 8.4.27-r0 and php85 8.5.12-r0 are now in the x86_64 community package index. Not every architecture is updated yet (x86, ppc64le, s390x and riscv64 still listed older builds at our check). https://patchbell.com/php/php2shell/ 2026-10-22 https://security-tracker.debian.org/tracker/CVE-2026-109618 Thu, 22 Oct 2026 00:00:00 GMT Fix released: Debian's security tracker lists php8.4 8.4.27-1 as the fix in unstable (sid) for both CVEs. Testing (forky) still has php8.4 8.4.26-1, which the tracker marks vulnerable. https://patchbell.com/php/php2shell/ 2026-10-22 https://deb.freexian.com/extended-lts/tracker/ELA-1853-1 Thu, 22 Oct 2026 00:00:00 GMT Status changed: Debian 11 (bullseye): Debian itself has no php7.4 entry for these CVEs because Long Term Support ended on 31 August 2026. Freexian's paid Extended LTS service lists 7.4.33-1+deb11u14 (ELA-1853-1), available only to its subscribers. https://patchbell.com/php/php2shell/ 2026-10-22 https://rpms.remirepo.net/enterprise/10/safe/x86_64/ Thu, 22 Oct 2026 00:00:00 GMT Fix released: Remi's repository (third-party) has PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 builds for Enterprise Linux 10, dated 21 October. Remi does not name the CVEs; these are the upstream fixed versions. https://patchbell.com/php/php2shell/ 2026-10-22 https://rpms.remirepo.net/enterprise/9/safe/x86_64/ Thu, 22 Oct 2026 00:00:00 GMT Fix released: Remi's repository (third-party) has PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 builds for Enterprise Linux 9, dated 21 October. Remi does not name the CVEs; these are the upstream fixed versions. https://patchbell.com/php/php2shell/ 2026-10-22 https://rpms.remirepo.net/enterprise/8/safe/x86_64/ Thu, 22 Oct 2026 00:00:00 GMT Fix released: Remi's repository (third-party) has PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 builds for Enterprise Linux 8, dated 21 October. Remi does not name the CVEs; these are the upstream fixed versions. https://patchbell.com/php/php2shell/ 2026-10-22 https://jvn.jp/vu/JVNVU99905564/ Thu, 22 Oct 2026 00:00:00 GMT Fix released: JVN (JPCERT/CC and IPA) published vulnerability note JVNVU#99905564 for both CVEs. It points to the PHP Group advisory and does not name fixed versions itself. https://patchbell.com/php/php2shell/ 2026-10-22 https://cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619 Thu, 22 Oct 2026 00:00:00 GMT Fix released: The Canadian Centre for Cyber Security published alert AL26-026 listing the fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It says a proof of concept is reported in open sources and that it has identified no active exploitation at this time. https://patchbell.com/php/php2shell/ 2026-10-22 https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ Thu, 22 Oct 2026 00:00:00 GMT Status changed: The PHP Foundation says proof-of-concept code circulated more widely on 21 October, and that its security team did not identify any functional exploits at the time of release. https://patchbell.com/php/php2shell/ 2026-10-22 https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do Thu, 22 Oct 2026 00:00:00 GMT Fix released: GoDaddy says Managed Hosting for WordPress is fully patched and needs no action. Web Hosting and Windows Hosting are mitigated while it waits for patched packages from its vendor, and VPS owners must update PHP themselves. https://patchbell.com/php/php2shell/ 2026-10-22 https://wpenginestatus.com/ Thu, 22 Oct 2026 00:00:00 GMT Fix released: WP Engine says it has finished deploying the PHP security patches on its platform and no action is needed (updated builds named: 7.4.33.17, 8.2.35, 8.4.27 and 8.5.12). https://patchbell.com/php/php2shell/ 2026-10-22 https://status.cloudways.com/ Thu, 22 Oct 2026 00:00:00 GMT Fix released: Cloudways says patches are applied for all customer applications on its Autonomous product and are still rolling out for applications on Flexible. https://patchbell.com/php/php2shell/ 2026-10-22 https://status.liquidweb.com/incidents/6bfpxwg75xgj Thu, 22 Oct 2026 00:00:00 GMT Fix released: Liquid Web published its patched build numbers (cPanel PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and Plesk v18.0.81.4) and says patched builds are still being deployed across its infrastructure. Customers who are not patched yet should run a package update in their control panel. https://patchbell.com/php/php2shell/ 2026-10-22 https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now Thu, 22 Oct 2026 00:00:00 GMT Fix released: DigitalOcean says the App Platform PHP buildpack is patched. You must redeploy your app to pick it up, and apps built from your own Dockerfile or image need PHP updated in that image. https://patchbell.com/php/php2shell/ 2026-10-22 https://docs.aws.amazon.com/elasticbeanstalk/latest/relnotes/release-2026-10-21-al2023-php84-php85.html Thu, 22 Oct 2026 00:00:00 GMT Fix released: AWS Elastic Beanstalk released Amazon Linux 2023 PHP 8.5 and PHP 8.4 platform versions (4.13.13) with PHP 8.5.12 and 8.4.27. A later release is to update the PHP 8.3 and PHP 8.2 platform branches. https://patchbell.com/php/php2shell/ 2026-10-22 https://docs.aws.amazon.com/lightsail/latest/userguide/amazon-lightsail-update-php-security-vulnerabilities.html Thu, 22 Oct 2026 00:00:00 GMT Fix released: AWS published Lightsail guidance for updating PHP yourself. Instances from Lightsail-packaged blueprints update PHP with the package manager; Bitnami-blueprint instances keep their own copy of PHP that apt upgrade does not update. AWS lists the fixed versions as 8.2.35, 8.3.36, 8.4.27 and 8.5.12. https://patchbell.com/php/php2shell/ 2026-10-22 https://www.netcup-status.de/ Thu, 22 Oct 2026 00:00:00 GMT Fix released: netcup says all Webhosting packages (including Reseller) and all Managed Servers are patched and online. Root server, VPS and managed cloud cluster customers must patch PHP themselves. https://patchbell.com/php/php2shell/ 2026-10-22 https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5 Thu, 22 Oct 2026 00:00:00 GMT Fix released: CloudLinux says its release of fixed alt-php packages is complete (22 October, 00:07 UTC) and a regular update installs them, followed by a PHP restart. The packages carry the fix as a backport and keep their own lower version numbers, so check the package changelog. https://patchbell.com/php/php2shell/ 2026-10-22 https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk Thu, 22 Oct 2026 00:00:00 GMT Fix released: Plesk says its own interface engine (sw-engine) is fixed in Plesk Obsidian 18.0.80 Update 11 and 18.0.81 Update 4, and asks customers to update Plesk to the latest available version. https://patchbell.com/php/php2shell/ 2026-10-22 https://www.aapanel.com/forum/d/26249-critical-php-security-update Thu, 22 Oct 2026 00:00:00 GMT Fix released: aaPanel now says patches are available in its App Store for PHP 7.4 to 8.5; update each installed PHP version there. Users on PHP 7.3 or older are pointed to configuration mitigation only. https://patchbell.com/php/php2shell/ 2026-10-22 https://help.sakura.ad.jp/notification/n-2700 Thu, 22 Oct 2026 00:00:00 GMT Fix released: Sakura Internet says the fix is complete for every PHP version selectable in the Rental Server and Managed Server control panel. phpMyAdmin and webmail used by some services are still being handled. https://patchbell.com/php/php2shell/ 2026-10-22 https://x.com/lolipopjp/status/2113121114809684114 Thu, 22 Oct 2026 00:00:00 GMT Fix released: GMO Pepabo says on its official X account that Lolipop has the fixed version applied and customer sites were restored at 13:11 JST on 22 October. It also applied its own fixes to older PHP versions that have no official fix. https://patchbell.com/php/php2shell/ 2026-10-22 https://heteml.jp/info/detail/id/2953 Thu, 22 Oct 2026 00:00:00 GMT Fix released: GMO Pepabo says heteml has the official fixed versions for the PHP 8 series and PHP 7.4, and its own fix for all other versions. Some functions are disabled on PHP 8.1 and below. https://patchbell.com/php/php2shell/ 2026-10-22 https://secure.colorfulbox.jp/announcements/231/%E9%87%8D%E8%A6%81PHP%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E5%AF%BE%E3%81%99%E3%82%8B%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3%E3%82%A2%E3%83%83%E3%83%97%E3%83%87%E3%83%BC%E3%83%88%E5%AE%8C%E4%BA%86%E3%81%AE%E3%81%8A%E7%9F%A5%E3%82%89%E3%81%9B%E3%81%8A%E5%AE%A2%E6%A7%98%E3%81%A7%E3%81%AE%E3%83%90%E3%83%BC%E3%82%B8%E3%83%A7%E3%83%B3%E5%A4%89%E6%9B%B4%E4%BD%9C%E6%A5%AD%E3%81%AF%E4%B8%8D%E8%A6%81%E3%81%A7%E3%81%99.html Thu, 22 Oct 2026 00:00:00 GMT Fix released: ColorfulBox says the security fix is complete on all its servers as of the morning of 22 October, and customers do not need to change their PHP version. https://patchbell.com/php/php2shell/ 2026-10-22 https://mixhost.jp/news/1974 Thu, 22 Oct 2026 00:00:00 GMT Fix released: mixhost says it finished applying the PHP fix packages on all its rental servers at about 10:18 JST on 22 October (PHP 5.2 to 8.5). The PHP version number shown does not change, and no customer action is needed. https://patchbell.com/php/php2shell/ 2026-10-22 https://www.conoha.jp/wing/news/?ap=2015054903 Thu, 22 Oct 2026 00:00:00 GMT Fix released: ConoHa says it is applying security patches to ConoHa WING servers in sequence and keeping each customer's current PHP version. https://patchbell.com/php/php2shell/ 2026-10-22 https://www.onamae.com/news/article/11591 Thu, 22 Oct 2026 00:00:00 GMT Fix released: GMO Internet says it is applying security patches to Onamae.com Rental Server servers in sequence and keeping each customer's current PHP version. A change may be needed for some customers on PHP 5.x or 7.x. https://patchbell.com/php/php2shell/ 2026-10-22 https://status.value-domain.com/information/detail/?info_id=916 Thu, 22 Oct 2026 00:00:00 GMT Fix released: Value Domain's status page says the fix is complete on CORESERVER V2 for every PHP version it offers, and on CORESERVER V1 for PHP 7.4 and later. Older PHP versions on V1 are not mentioned. https://patchbell.com/php/php2shell/ 2026-10-22 https://status.value-domain.com/information/detail/?info_id=919 Thu, 22 Oct 2026 00:00:00 GMT Fix released: Value Domain's status page says the fix is complete on XREA for PHP 7.4 and later. Older PHP versions are not mentioned. https://patchbell.com/php/php2shell/ 2026-10-22 https://status.value-domain.com/information/detail/?info_id=918 Thu, 22 Oct 2026 00:00:00 GMT Fix released: Value Domain's status page says the fix is complete on VALUESERVER for PHP 7.4 and later. Older PHP versions are not mentioned. https://patchbell.com/php/php2shell/ 2026-10-22 https://status.value-domain.com/information/detail/?info_id=920 Thu, 22 Oct 2026 00:00:00 GMT Fix released: Value Domain's status page says the fix is complete on One Rental Server for PHP 8.0 and later. Older PHP versions are not mentioned. https://patchbell.com/php/php2shell/ 2026-10-22 https://help.arena.ne.jp/hc/ja/articles/44408280593303 Thu, 22 Oct 2026 00:00:00 GMT Fix released: NTTPC published a notice for WebARENA SuiteX naming both CVEs. Web access from outside Japan is restricted and one PHP function (file-upload progress) is disabled as mitigations; the notice does not say a PHP fix has been applied. https://patchbell.com/php/php2shell/ 2026-10-21 https://www.cve.org/CVERecord?id=CVE-2026-109618 Wed, 21 Oct 2026 13:48:34 GMT Disclosed: Disclosed in the CVE record published by the PHP Group. https://patchbell.com/php/php2shell/ 2026-10-21 https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ Wed, 21 Oct 2026 00:00:00 GMT Status changed: AWS (Amazon Threat Intelligence) says php2shell is now being broadly exploited in the wild, and that its honeypot sensors recorded an exploitation attempt dated 17 Oct, four days before disclosure. AWS adds that it is unclear whether those attempts succeeded on real systems. CISA's KEV catalog does not list either CVE as of 22 Oct. https://patchbell.com/php/php2shell/ 2026-10-21 https://access.redhat.com/errata/RHSA-2026:87080 Wed, 21 Oct 2026 00:00:00 GMT Fix released: Red Hat released RHSA-2026:87080 for RHEL 8 php:7.4 (7.4.33-8.module+el8.10.0+25117+30337cca), which fixes both CVEs. https://patchbell.com/php/php2shell/ 2026-10-21 https://secdb.alpinelinux.org/v3.24/community.json Wed, 21 Oct 2026 00:00:00 GMT Status changed: Alpine 3.24: php83 8.3.36-r0, php84 8.4.27-r0 and php85 8.5.12-r0 are now in the x86_64 community repository. On Alpine edge, php83 8.3.36-r0 is listed in the security database but the package is not in the repository yet. https://patchbell.com/php/php2shell/ 2026-10-21 https://formulae.brew.sh/api/formula/php.json Wed, 21 Oct 2026 00:00:00 GMT Status changed: Homebrew: php is now 8.5.12, php@8.4 is 8.4.27, php@8.3 is 8.3.36 and php@8.2 is 8.2.35. https://patchbell.com/php/php2shell/ 2026-10-21 https://nvd.nist.gov/vuln/detail/CVE-2026-109618 Wed, 21 Oct 2026 00:00:00 GMT Status changed: NVD added its own CVSS 3.1 score of 9.8 (Critical) for both CVEs, and its affected-version data now also covers PHP versions older than 8.2.35. https://patchbell.com/php/php2shell/ 2026-10-21 https://laravel.com/blog/php-critical-vulnerability-response-updates Wed, 21 Oct 2026 00:00:00 GMT Fix released: Laravel Cloud says every running application is now patched (PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35).