PHP shipped emergency fixes for CVE-2026-109618 and CVE-2026-109619 on 21 October 2026. Linux distributions did not simply ship the new PHP version. They patched the version they already carry, so the number printed by php -v can stay the same on a fixed server. This page lists the exact fixed package for each distribution release, as published by the vendor, and shows how to confirm yours. Status is as of 23 October 2026.
For what the flaws are and what to do first, read the main article: PHP2Shell (CVE-2026-109618, CVE-2026-109619): What to Do Now.
Short version
- Upstream fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older have no upstream fix.
- Ubuntu, Debian and Red Hat backport the fix. Do not judge your server by the PHP version number alone. Check the package version or changelog.
- After updating, restart PHP-FPM or Apache. A running process keeps using the old code until it is restarted.
- Some releases have no free fix: Ubuntu 14.04 to 20.04 need Ubuntu Pro, Amazon Linux 2 core php and Amazon Linux 2023 php8.1 show no fix planned, and Debian 11 is not listed on Debian’s tracker.
The story, for anyone who is not a tech person
Think of a car recall. The maker finds a faulty part and replaces it in every car already sold. The model name on the back of the car does not change. A car called the same thing before the recall is called the same thing after it.
PHP version numbers behave like that model name. Ubuntu, Debian and Red Hat fix the faulty part inside the version they already ship, so the name on the label can look old even though the repair is done. The label that really tells you is the service record, which for software is the package changelog and the package release number.
The repair also does nothing until the engine is restarted. A web server that has been running for weeks is still running the old part in memory. Installing the update puts the new part in the garage. Restarting PHP-FPM or Apache is what actually fits it.
Some old cars are no longer covered by the maker’s free recall. For those, the owner either pays for an extended service plan, which is what Ubuntu Pro is for the oldest Ubuntu releases, or moves to a newer car, which means upgrading the operating system.
What it means in practice
- Compare your installed package with the table below, not just your PHP version.
- Restart the PHP service after the update.
- If your release has no free fix, plan an upgrade or a paid support plan.
Ubuntu
Ubuntu published USN-8948-1 and USN-8948-2 on 21 October 2026. Both CVEs are covered.
| Ubuntu release | Package | Fixed version | Notice |
|---|---|---|---|
| 26.10 | php8.5 | 8.5.9-0ubuntu2.1 | USN-8948-1 |
| 26.04 LTS | php8.5 | 8.5.4-0ubuntu1.5 | USN-8948-1 |
| 24.04 LTS | php8.3 | 8.3.6-0ubuntu0.24.04.13 | USN-8948-1 |
| 22.04 LTS | php8.1 | 8.1.2-1ubuntu2.28 | USN-8948-1 |
| 20.04 LTS | php7.4 | 7.4.3-4ubuntu2.29+esm5 | USN-8948-2, Ubuntu Pro |
| 18.04 LTS | php7.2 | 7.2.24-0ubuntu0.18.04.17+esm14 | USN-8948-2, Ubuntu Pro |
| 16.04 LTS | php7.0 | 7.0.33-0ubuntu0.16.04.16+esm22 | USN-8948-2, Ubuntu Pro with Legacy Support add-on |
| 14.04 LTS | php5 | 5.5.9+dfsg-1ubuntu4.29+esm18 | USN-8948-2, Ubuntu Pro with Legacy Support add-on |
Each version above is the first fixed version for that release. A newer version of the same package also contains the fix. The affected binary packages include the CLI, CGI, FPM and Apache module builds for that PHP version.
Debian
| Debian release | Source package | Fixed version | Advisory |
|---|---|---|---|
| 13 (trixie) | php8.4 | 8.4.27-1~deb13u1 | DSA-6574-1, 21 October 2026 |
| 12 (bookworm) | php8.2 | 8.2.35-1~deb12u1 | DLA-4848-1, Debian security tracker |
| sid (unstable) | php8.4 | 8.4.27-1 | Debian security tracker |
Debian 11 (bullseye) is not listed on the Debian security tracker page for CVE-2026-109618, so no fixed package is published there.
Red Hat Enterprise Linux
Red Hat published bulletin RHSB-2026-013 on 21 October 2026 and rates it Important. It lists RHEL 10, 9 and 8 as affected, and RHEL 7 as affected by CVE-2026-109619 only. The bulletin says some updates are available and more are in progress, and that no mitigation is published yet. Fixed packages depend on the PHP module stream you use.
| RHEL | Stream | Fixed package | Advisory |
|---|---|---|---|
| 9 | php:8.2 | php-8.2.35-1.module+el9.8.0+25111+a1450321 | RHSA-2026:87072 |
| 8 | php:7.4 | php-7.4.33-8.module+el8.10.0+25117+30337cca | RHSA-2026:87080 |
For other streams, list the advisories that mention the CVE on your own system:
dnf updateinfo list --cve CVE-2026-109618Red Hat’s bulletin says standard RHEL setups use PHP-FPM and that PHP-FPM workers exit on early initialisation failures before reaching the corrupted structures, which makes exploitation hard in practice. It describes mod_php with default settings as the higher-risk setup. Rebuild customer containers after the base image is updated.
Amazon Linux
| Product | Status | Advisory |
|---|---|---|
| Amazon Linux 2, php8.2 (Extra) | Fixed | ALAS2PHP8.2-2026-015 |
| Amazon Linux 2023, php8.2 | Fixed | ALAS2023-2026-3301 |
| Amazon Linux 2023, php8.3 | Fixed | ALAS2023-2026-3302 |
| Amazon Linux 2023, php8.4 | Fixed | ALAS2023-2026-3303 |
| Amazon Linux 2023, php8.5 | Fixed | ALAS2023-2026-3304 |
| Amazon Linux 2027 Preview, php8.5 | Fixed | ALAS2027-2026-243 |
| Amazon Linux 2, php (core) | No fix planned | none |
| Amazon Linux 2023, php8.1 | No fix planned | none |
Amazon’s page lists status and advisory IDs but not package versions, so use the advisory to see the fixed build.
How to confirm your server is patched
On Debian and Ubuntu, install the update, then read the package changelog for the CVE. Replace 8.3 with your PHP version.
sudo apt update && sudo apt install --only-upgrade php8.3-cli php8.3-fpm
apt changelog php8.3-cli | grep -i CVE-2026-109618
dpkg -l | grep php8.3On RHEL and compatible systems, check the RPM changelog:
sudo dnf update php\*
rpm -q --changelog php | grep -i CVE-2026-109618Then restart the service that runs PHP, for example sudo systemctl restart php8.3-fpm or sudo systemctl restart apache2, and confirm the new process start time with systemctl status.
Not covered here
Alpine Linux, the official PHP Docker images, cPanel and Plesk are not listed above because their vendor pages were not verified for this article. Check their own advisories. For containers, rebuild from an updated base image and redeploy.
Frequently Asked Questions
Why does php -v still show an old version after patching?
Ubuntu, Debian and Red Hat backport the fix into the PHP version they already ship, so the PHP version number stays the same and only the package release changes. Check the package version or the changelog for the CVE instead.
Which Ubuntu package version fixes CVE-2026-109618 on 22.04 and 24.04?
According to USN-8948-1, the fixed versions are php8.1 8.1.2-1ubuntu2.28 on Ubuntu 22.04 LTS and php8.3 8.3.6-0ubuntu0.24.04.13 on Ubuntu 24.04 LTS.
Is there a fix for Ubuntu 14.04, 16.04, 18.04 and 20.04?
Yes, through Ubuntu Pro. USN-8948-2 lists 5.5.9+dfsg-1ubuntu4.29+esm18 for 14.04, 7.0.33-0ubuntu0.16.04.16+esm22 for 16.04, 7.2.24-0ubuntu0.18.04.17+esm14 for 18.04 and 7.4.3-4ubuntu2.29+esm5 for 20.04. The 14.04 and 16.04 fixes need the Legacy Support add-on.
What is the fixed PHP package on Debian 12 and Debian 13?
Debian’s security tracker lists php8.2 8.2.35-1~deb12u1 for Debian 12 and php8.4 8.4.27-1~deb13u1 for Debian 13. Debian 13 is covered by DSA-6574-1.
Do I need to restart PHP after applying the update?
Yes. A running PHP-FPM or Apache process keeps using the old code in memory until it is restarted, so restart the service after the package update.
Sources and method
Sources: USN-8948-1, USN-8948-2, Debian DSA-6574-1, Debian security tracker, Red Hat RHSB-2026-013, RHSA-2026:87072, RHSA-2026:87080, Amazon Linux Security Center and the PHP release page. Vendor pages change as updates roll out. Status as of 23 October 2026. Red Hat lists only two streams here; other RHEL streams are still rolling out.
Related Articles:
PHP2Shell (CVE-2026-109618, CVE-2026-109619): What to Do Now
You can also read this article on Medium.
Connect with me on LinkedIn.
Leave a Reply