Upstream PHP2Shell fix included
PHP 8.4.27 is a stable upstream PHP vulnerability security release, published 2026-10-21. The branch remains subject to its published support policy.
Read the PHP change log ↗Find the package for your platform
The upstream release does not mean every vendor package or image is available. Compare your vendor source before applying this PHP vulnerability update.
| Branch / source | Confirmed package | PHP2Shell status |
|---|---|---|
| PHP 8.4 ondrej-ppa | See vendor advisory Source ↗ | Status not confirmed — check vendor advisory Checked at 2026-10-21 15:26:10 UTC |
| PHP 8.4 debian-security · 13 | 8.4.27-1~deb13u1 Source ↗ | Fix confirmed Checked at 2026-10-21 15:26:08 UTC |
| PHP 8.4 docker-library | See vendor advisory Source ↗ | Fix not yet confirmed in packages Checked at 2026-10-21 15:26:15 UTC |
| PHP 8.4 easyapache4 | See vendor advisory Source ↗ | Fix confirmed Checked at 2026-10-21 15:26:16 UTC |
Verify the running release
Use the tested commands in your platform guide. A short PHP version can miss a distribution backport. Confirm the full package revision, restart the serving workers, and check the web runtime before considering the update complete.
Record the installed source and check the runtime assigned to each website.
Check the version actually serving your site →