Scanners and AI agents misjudge PHP2Shell fixes

After the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) were disclosed, scanners and AI agents give wrong answers in both directions: patched Ubuntu, RHEL and Chainguard builds show as vulnerable, while PHP 8.1 and older branches are marked unaffected despite source fixes back to 5.4.

• Fixes shipped in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12
• Ubuntu and RHEL keep old version numbers, breaking upstream comparison
• The CVE-2026-109618 record omits PHP 8.1 and older as affected
• Check package versions and restart PHP-FPM processes