PHP2Shell security updateLast updated: 2026-10-22 (UTC)

PHP vulnerability downloads and regional resources

Download checksum-verified PHP2Shell source releases from php.net or our R2 mirror. Find repository guidance for networks with restricted access.

PHP2Shell · CVE-2026-109618 / CVE-2026-109619 · PHP RCE · PHP security update

Choose the download that matches your installation

For Ubuntu, Debian and managed panels, use the vendor's signed repository or updater. The archives below contain upstream source code for experienced administrators who already build PHP. They are not ready-to-install distribution packages and do not update an existing website by themselves.

A PHP vulnerability fix needs the correct runtime build, extensions and service restart. Keep your current package source unless you have a tested migration plan. The Windows PHP project publishes separate binaries for Windows.

Windows downloads and runtime selection →

Verified upstream source archives

These copies are unmodified. Their SHA-256 values were checked against php.net release metadata before upload. Compare the downloaded file with the value below using your operating system's checksum utility. The original license remains inside each archive and is also available separately.

PHP 8.5.12

Source archive · 13.9 MiB · php-8.5.12.tar.xz

Official download ↗Download from this site's R2 mirror ↓License ↓

SHA-256: 08bc2eba2a588654ade1357174aa646b761556c862dda0678345ee29ed481209

Checked at 2026-10-21 23:23:15.220834 UTC · Official checksum metadata ↗

PHP 8.4.27

Source archive · 13.2 MiB · php-8.4.27.tar.xz

Official download ↗Download from this site's R2 mirror ↓License ↓

SHA-256: dcf93923b0e38e0d5252b25b796520b5a47761a08b3488b6d0b5d1115764d3f0

Checked at 2026-10-21 23:23:19.573746 UTC · Official checksum metadata ↗

PHP 8.3.36

Source archive · 12.1 MiB · php-8.3.36.tar.xz

Official download ↗Download from this site's R2 mirror ↓License ↓

SHA-256: dd54693aa334c5c4d72e9aee96b082c2473750a18a6c1d105789c93a3b1692fd

Checked at 2026-10-21 23:23:23.677345 UTC · Official checksum metadata ↗

PHP 8.2.35

Source archive · 11.7 MiB · php-8.2.35.tar.xz

Official download ↗Download from this site's R2 mirror ↓License ↓

SHA-256: 5737b98601fe5ab1b8c5db0c82ed3158acb9283ed3081ffe2faffb9ac81455e6

Checked at 2026-10-21 23:23:27.788933 UTC · Official checksum metadata ↗

Regional package resources

These links lead to mirror operators' own instructions. They can offer another network route, but mirror freshness and local connectivity vary. A nearby mirror is not automatically faster or current. Preserve package signature checks and verify the full PHP vulnerability fix revision after updating.

Tsinghua TUNA Ubuntu mirror documentation ↗

Mainland China: The documented Ubuntu mirror covers x86; ARM uses ubuntu-ports. Keep the security archive configuration unless you have independently confirmed mirror freshness.

Documentation checked at 2026-10-21 23:23:00 UTC

USTC Debian mirror documentation ↗

Mainland China: Use the instructions for the exact Debian release and review the separate Debian Security repository. Mirror documentation is not confirmation that a particular security package has synchronized.

Documentation checked at 2026-10-21 23:23:00 UTC

Debian worldwide mirror list ↗

Worldwide: Choose a nearby mirror through Debian's list. Availability and synchronization of a specific fixed package must still be checked.

Documentation checked at 2026-10-21 23:36:33.039473+00:00

Mirror scope and network limits

This site's R2 mirror stores the listed upstream archives only. It does not mirror a complete operating-system repository, container registry or licensed vendor package collection. Files remain available through the official source as well. R2 delivery cannot guarantee access in every country or network.

Downloading an archive does not establish that the PHP vulnerability has been fixed on your server. Verify the installed package and every serving PHP process after applying the update.

Verify the installed runtime →

Sources & verification

Checked at 2026-10-22 03:29:51 UTC. Vendor publication and installed runtime verification are separate checks.