{
  "schema": 1,
  "id": "php2shell",
  "lastUpdated": "2026-10-22",
  "lastUpdatedNote": "Vendor patch status is moving quickly. Anything not listed as fixed below is reported as 'unconfirmed', never as safe.",
  "vulnerability": {
    "name": "PHP2Shell",
    "cves": [
      {
        "id": "CVE-2026-109618",
        "cvss": "9.2",
        "cvssVersion": "4.0",
        "summary": "Memory corruption during request (multipart) parsing when an allocation fails; the upload-progress path can disclose freed worker memory and leads to unauthenticated RCE."
      },
      {
        "id": "CVE-2026-109619",
        "cvss": "9.2",
        "cvssVersion": "4.0",
        "summary": "Use-after-free: a fatal error interrupts per-request cleanup, leaving stale pointers that a later request reuses (exploitation confirmed on 8.5 with fatal_error_backtraces enabled)."
      }
    ],
    "advisory": "GHSA-w8hw-w9fx-j79w",
    "released": "2026-10-21",
    "exploitation": "Exploitation reported in the wild before and after the 21 Oct 2026 release; public proof-of-concept details exist.",
    "affected": "Reported as affecting PHP 5.x onwards, including all 7.x and 8.x builds before the fixed releases. Default configurations are vulnerable."
  },
  "upstream": {
    "branches": {
      "8.5": { "fixed": "8.5.12", "supported": true },
      "8.4": { "fixed": "8.4.27", "supported": true },
      "8.3": { "fixed": "8.3.36", "supported": true },
      "8.2": { "fixed": "8.2.35", "supported": true }
    },
    "eolNote": "PHP 8.1 and earlier are end of life and receive no upstream fix. Only a distribution backport (or an upgrade to 8.2+) closes the hole.",
    "source": "https://www.php.net/archive/2026.php"
  },
  "distros": [
    {
      "family": "ubuntu",
      "label": "Ubuntu 22.04 LTS (jammy)",
      "osVersion": "22.04",
      "package": "php8.1",
      "status": "fixed",
      "fixed": "8.1.2-1ubuntu2.28",
      "ref": "USN-8948-1",
      "source": "https://ubuntu.com/security/CVE-2026-109618"
    },
    {
      "family": "ubuntu",
      "label": "Ubuntu 24.04 LTS (noble)",
      "osVersion": "24.04",
      "package": "php8.3",
      "status": "fixed",
      "fixed": "8.3.6-0ubuntu0.24.04.13",
      "ref": "USN-8948-1",
      "note": "Backport: the upstream version stays 8.3.6, so 'php -v' alone cannot tell you it is patched.",
      "source": "https://ubuntu.com/security/CVE-2026-109618"
    },
    {
      "family": "ubuntu",
      "label": "Ubuntu 26.04 LTS (resolute)",
      "osVersion": "26.04",
      "package": "php8.5",
      "status": "fixed",
      "fixed": "8.5.4-0ubuntu1.5",
      "ref": "USN-8948-1",
      "source": "https://ubuntu.com/security/CVE-2026-109618"
    },
    {
      "family": "ubuntu",
      "label": "Ubuntu 26.10",
      "osVersion": "26.10",
      "package": "php8.5",
      "status": "fixed",
      "fixed": "8.5.9-0ubuntu2.1",
      "ref": "USN-8948-1",
      "source": "https://ubuntu.com/security/CVE-2026-109618"
    },
    {
      "family": "debian",
      "label": "Debian 12 (bookworm)",
      "osVersion": "12",
      "package": "php8.2",
      "status": "fixed",
      "fixed": "8.2.35-1~deb12u1",
      "ref": "DLA-4848-1",
      "source": "https://security-tracker.debian.org/tracker/CVE-2026-109618"
    },
    {
      "family": "debian",
      "label": "Debian 13 (trixie)",
      "osVersion": "13",
      "package": "php8.4",
      "status": "fixed",
      "fixed": "8.4.27-1~deb13u1",
      "ref": "DSA-6574-1",
      "source": "https://security-tracker.debian.org/tracker/CVE-2026-109618"
    },
    {
      "family": "debian",
      "label": "Debian 11 (bullseye)",
      "osVersion": "11",
      "package": "php7.4",
      "status": "unconfirmed",
      "note": "Not listed on the Debian tracker at time of writing.",
      "source": "https://security-tracker.debian.org/tracker/CVE-2026-109618"
    },
    {
      "family": "rhel",
      "label": "RHEL 8 · php:7.4 module",
      "osVersion": "8",
      "stream": "7.4",
      "package": "php",
      "status": "fixed",
      "fixed": "7.4.33-8.module+el8.10.0+25117+30337cca",
      "ref": "RHSA-2026:87080",
      "note": "Backport: version stays 7.4.33; the release number (-8) carries the fix.",
      "source": "https://access.redhat.com/errata/RHSA-2026:87080"
    },
    {
      "family": "rhel",
      "label": "RHEL 9 · php:8.2 module",
      "osVersion": "9",
      "stream": "8.2",
      "package": "php",
      "status": "fixed",
      "fixed": "8.2.35-1.module+el9.8.0+25111+a1450321",
      "ref": "RHSA-2026:87072",
      "source": "https://access.redhat.com/errata/RHSA-2026:87072"
    },
    {
      "family": "rhel",
      "label": "RHEL 8 · php:8.2 module",
      "osVersion": "8",
      "stream": "8.2",
      "package": "php",
      "status": "unconfirmed",
      "note": "Red Hat bulletin RHSB-2026-013 lists updates as ongoing.",
      "source": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-013"
    },
    {
      "family": "rhel",
      "label": "RHEL 9 · default php (8.0) and php:8.3",
      "osVersion": "9",
      "stream": "8.0,8.3",
      "package": "php",
      "status": "unconfirmed",
      "source": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-013"
    },
    {
      "family": "rhel",
      "label": "RHEL 10 · php 8.3 / 8.4",
      "osVersion": "10",
      "stream": "8.3,8.4",
      "package": "php",
      "status": "unconfirmed",
      "source": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-013"
    },
    {
      "family": "rhel",
      "label": "RHEL 8 · php:7.2 / 7.3 / 8.0 and RHEL 9 · php:8.1 (retired streams)",
      "osVersion": "8,9",
      "stream": "7.2,7.3,8.0,8.1",
      "package": "php",
      "status": "unconfirmed",
      "note": "AlmaLinux lists these as retired and not in the first patch round. Move to a supported stream.",
      "source": "https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/"
    }
  ],
  "rhelRebuildNote": "AlmaLinux, Rocky Linux and Oracle Linux rebuild RHEL packages with their own release tags. The tool compares version and the leading release number against Red Hat's fix; confirm against your vendor's own errata.",
  "thirdPartyRepos": [
    {
      "id": "sury",
      "label": "Ondřej Surý (deb.sury.org / ppa:ondrej/php)",
      "rule": "upstream",
      "note": "Packages track upstream versions (e.g. 8.4.27-1+ubuntu24.04.1+deb.sury.org+1). Fixed when the upstream part is at or above the fixed release. Branches 8.1 and older: unconfirmed.",
      "source": "https://laravel.com/forge/docs/knowledge-base/php-security-release-october-2026"
    },
    {
      "id": "remi",
      "label": "Remi (rpms.remirepo.net)",
      "rule": "upstream",
      "note": "Tracks upstream versions. Sansec reported the fix was not yet in Remi on 21 Oct 2026.",
      "source": "https://sansec.io/research/php2shell"
    },
    {
      "id": "windows",
      "label": "Windows builds (windows.php.net)",
      "rule": "upstream",
      "note": "Official Windows builds use upstream version numbers.",
      "source": "https://www.php.net/archive/2026.php"
    },
    {
      "id": "docker",
      "label": "Official Docker images (php:*)",
      "rule": "upstream",
      "note": "Read PHP_VERSION inside the container. Rebuilt images carry the fixed upstream version; pull and redeploy, a restart alone does not update the image.",
      "source": "https://hub.docker.com/_/php"
    }
  ],
  "sources": [
    { "title": "PHP news archive 2026 (security release 21 Oct 2026)", "url": "https://www.php.net/archive/2026.php" },
    { "title": "Sansec: PHP2Shell critical PHP RCE", "url": "https://sansec.io/research/php2shell" },
    { "title": "SANS ISC diary: Critical PHP vulnerability (infocon yellow)", "url": "https://isc.sans.edu/diary/Critical+PHP+Vulnerability+CVE2026109618+CVE2026109619+infocon+yellow/33440" },
    { "title": "Red Hat RHSB-2026-013 (php2shell)", "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-013" },
    { "title": "Ubuntu CVE-2026-109618", "url": "https://ubuntu.com/security/CVE-2026-109618" },
    { "title": "Debian security tracker CVE-2026-109618", "url": "https://security-tracker.debian.org/tracker/CVE-2026-109618" },
    { "title": "AlmaLinux: php2shell patched packages", "url": "https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/" },
    { "title": "Laravel Forge: PHP security advisory", "url": "https://laravel.com/forge/docs/knowledge-base/php-security-release-october-2026" }
  ]
}