Security1 hOctober 25, 2026, 12:13

How to verify the PHP2Shell patch is actually live

The critical PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) were fixed on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Updating the package is not enough: every PHP worker must restart, containers must be rebuilt, and the fix must be verified on the production server, with session.upload_progress disabled.

DEV Community

Open source

How to verify the PHP2Shell patch is actually live

CVSS 9.2 flaws fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
Old PHP-FPM and Apache workers keep running until restarted
On Ubuntu and Debian the PHP version number stays the same due to backports
Disabling session.upload_progress.enabled is recommended

#PHP

PHP2Shell: patch-verification and hunting plan before disclosure

Security

PHP2Shell: sites on PHP 8.1 and older left without a patch

Security

NSA urges immediate PHP patching as AI-found PHP2Shell flaws hit ~70% of the web

Security

How to verify the PHP2Shell patch is actually live

PHP2Shell: patch-verification and hunting plan before disclosure

PHP2Shell: sites on PHP 8.1 and older left without a patch

NSA urges immediate PHP patching as AI-found PHP2Shell flaws hit ~70% of the web

PHP2Shell flaws hit NAS devices: Synology patched, QNAP still waiting