PHP2Shell sources & verification records

PHP 8.5 · ubuntu-archive · 26.04

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.5 · ubuntu-archive · 26.10

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.5 · ondrej-ppa

Launchpad Jammy and Noble binary indexes contain the fixed supported releases for amd64 and arm64. See the architecture table for exact revisions; EOL backport contents require separate evidence.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.4 · ondrej-ppa

Launchpad Jammy and Noble binary indexes contain the fixed supported releases for amd64 and arm64. See the architecture table for exact revisions; EOL backport contents require separate evidence.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.3 · ubuntu-archive · 24.04

Ubuntu backports the fix. Compare the full package revision, not only the PHP version.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.3 · ondrej-ppa

Launchpad Jammy and Noble binary indexes contain the fixed supported releases for amd64 and arm64. See the architecture table for exact revisions; EOL backport contents require separate evidence.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.2 · ondrej-ppa

Launchpad Jammy and Noble binary indexes contain the fixed supported releases for amd64 and arm64. See the architecture table for exact revisions; EOL backport contents require separate evidence.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.1 · ubuntu-archive · 22.04

The Ubuntu archive includes a backport. The upstream branch remains end-of-life.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.1 · ondrej-ppa

Launchpad Jammy and Noble binary indexes contain the fixed supported releases for amd64 and arm64. See the architecture table for exact revisions; EOL backport contents require separate evidence.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.0 · ondrej-ppa

Launchpad Jammy and Noble binary indexes contain the fixed supported releases for amd64 and arm64. See the architecture table for exact revisions; EOL backport contents require separate evidence.

Checked at: 2026-10-22 03:28:58 UTC

PHP 7.4 · ondrej-ppa

Launchpad Jammy and Noble binary indexes contain the fixed supported releases for amd64 and arm64. See the architecture table for exact revisions; EOL backport contents require separate evidence.

Checked at: 2026-10-22 03:28:58 UTC

PHP 7.4 · ubuntu-esm · 20.04

USN-8948-2 confirms the vendor backport. Ubuntu Pro access is required; entitled-package installation has not been tested here.

Checked at: 2026-10-22 03:29:00 UTC

PHP 7.2 · ubuntu-esm · 18.04

USN-8948-2 confirms the vendor backport. Ubuntu Pro access is required; entitled-package installation has not been tested here.

Checked at: 2026-10-22 03:29:00 UTC

PHP 7.0 · ubuntu-esm · 16.04

USN-8948-2 confirms the vendor backport. Ubuntu Pro access is required; entitled-package installation has not been tested here.

Checked at: 2026-10-22 03:29:00 UTC

PHP 5.5 · ubuntu-esm · 14.04

USN-8948-2 confirms the vendor backport. Ubuntu Pro access is required; entitled-package installation has not been tested here.

Checked at: 2026-10-22 03:29:00 UTC

PHP 8.2 · sury · Ubuntu 22.04 (jammy) · arm64

Sury ARM64 PHP vulnerability fix availability depends on the exact distribution, branch and package. Confirmed combinations have checksum-verified CLI, common and FPM artifacts listed below; other combinations remain unverified. An EOL build date alone does not establish a backport.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.1 · sury · Ubuntu 24.04 (noble) · arm64

The downloaded Sury Ubuntu 24.04 ARM64 common package changelog explicitly lists both CVEs in this PHP vulnerability backport. CLI, common and FPM revisions are present and their downloaded checksums match the official index. Installation was not tested; this confirmation applies only to the listed release and architecture.

Checked at: 2026-10-22 12:43:38 UTC

PHP 7.4 · sury · Ubuntu 24.04 (noble) · arm64

The downloaded Sury Ubuntu 24.04 ARM64 common package changelog explicitly lists both CVEs in this PHP vulnerability backport. CLI, common and FPM revisions are present and their downloaded checksums match the official index. Installation was not tested; this confirmation applies only to the listed release and architecture.

Checked at: 2026-10-22 16:39:41 UTC

PHP 7.4 · sury · Ubuntu 22.04 (jammy) · arm64

The downloaded Sury Ubuntu 22.04 ARM64 common package changelog explicitly lists both CVEs in this PHP vulnerability backport. CLI, common and FPM revisions are present and their downloaded checksums match the official index. Installation was not tested; this confirmation applies only to the listed release and architecture.

Checked at: 2026-10-23 00:47:27 UTC

PHP 8.0 · sury · Ubuntu 24.04 (noble) · arm64

The downloaded Sury Ubuntu 24.04 ARM64 common package changelog explicitly lists both CVEs in this PHP vulnerability backport. CLI, common and FPM revisions are present and their downloaded checksums match the official index. Installation was not tested; this confirmation applies only to the listed release and architecture.

Checked at: 2026-10-23 00:47:27 UTC

PHP 8.5 · sury

Sury ARM64 PHP vulnerability fix availability depends on the exact distribution, branch and package. Confirmed combinations have checksum-verified CLI, common and FPM artifacts listed below; other combinations remain unverified. An EOL build date alone does not establish a backport.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.4 · debian-security · 13

Debian security tracker confirms the security archive package.

Checked at: 2026-10-22 03:28:59 UTC

PHP 8.3 · sury

Sury ARM64 PHP vulnerability fix availability depends on the exact distribution, branch and package. Confirmed combinations have checksum-verified CLI, common and FPM artifacts listed below; other combinations remain unverified. An EOL build date alone does not establish a backport.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.2 · debian-lts · 12

DLA-4848-1 and the Debian security tracker confirm the fix. A fresh Debian 12 ARM64 container installed the fixed package and passed the published update and service-restart commands.

Checked at: 2026-10-22 03:28:59 UTC

PHP 8.1 · sury

Sury ARM64 PHP vulnerability fix availability depends on the exact distribution, branch and package. Confirmed combinations have checksum-verified CLI, common and FPM artifacts listed below; other combinations remain unverified. An EOL build date alone does not establish a backport.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.0 · sury

Sury ARM64 PHP vulnerability fix availability depends on the exact distribution, branch and package. Confirmed combinations have checksum-verified CLI, common and FPM artifacts listed below; other combinations remain unverified. An EOL build date alone does not establish a backport.

Checked at: 2026-10-22 08:51:47 UTC

PHP 7.4 · sury · 11

Sury ARM64 PHP vulnerability fix availability depends on the exact distribution, branch and package. Confirmed combinations have checksum-verified CLI, common and FPM artifacts listed below; other combinations remain unverified. An EOL build date alone does not establish a backport.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.0 · sury · Debian 13 (trixie) · arm64

The downloaded Sury Debian 13 ARM64 common package changelog explicitly lists both CVEs in this PHP vulnerability backport. CLI, common and FPM revisions are present and their downloaded checksums match the official index. Installation was not tested; this confirmation applies only to the listed release and architecture.

Checked at: 2026-10-22 08:51:47 UTC

PHP 7.4 · sury · Debian 12 (bookworm) · arm64

The downloaded Sury Debian 12 ARM64 common package changelog explicitly lists both CVEs in this PHP vulnerability backport. CLI, common and FPM revisions are present and their downloaded checksums match the official index. Installation was not tested; this confirmation applies only to the listed release and architecture.

Checked at: 2026-10-22 12:43:38 UTC

PHP 8.5 · sury · Debian 12 (bookworm) · arm64

The downloaded Sury Debian 12 ARM64 common package changelog explicitly lists both CVEs in this PHP vulnerability update. CLI, common and FPM revisions are present and their downloaded checksums match the official index. Installation was not tested; this confirmation applies only to the listed release and architecture.

Checked at: 2026-10-22 16:39:41 UTC

PHP 8.5 · docker-library

The exact stable CLI image was pulled and its runtime verified on ARM64. FPM, Apache, Alpine and other architectures require separate checks. Recreate existing serving containers using your deployment process.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.4 · docker-library

The exact stable CLI image was pulled and ran PHP 8.4.27 on ARM64. This verifies that variant only; verify FPM, Apache, Alpine and other architectures separately. Existing serving containers must still be rebuilt or recreated through your deployment process.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.3 · docker-library

The exact stable CLI image was pulled and its runtime verified on ARM64. FPM, Apache, Alpine and other architectures require separate checks. Recreate existing serving containers using your deployment process.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.2 · docker-library

The exact stable CLI image was pulled and its runtime verified on ARM64. FPM, Apache, Alpine and other architectures require separate checks. Recreate existing serving containers using your deployment process.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.1 · docker-library

Image publication must be confirmed by pulling the exact stable tag and checking the runtime. Release-candidate tags are not evidence of a fix.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.0 · docker-library

Image publication must be confirmed by pulling the exact stable tag and checking the runtime. Release-candidate tags are not evidence of a fix.

Checked at: 2026-10-22 03:28:58 UTC

PHP 7.4 · docker-library

Image publication must be confirmed by pulling the exact stable tag and checking the runtime. Release-candidate tags are not evidence of a fix.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.5 · easyapache4

EasyApache 4 change log 25.91 confirms this branch update. Confirm the installed EA4 package and restart the serving runtime.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.4 · easyapache4

EasyApache 4 change log 25.91 confirms this branch update. Confirm the installed EA4 package and restart the serving runtime.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.3 · easyapache4

EasyApache 4 change log 25.91 confirms this branch update. Confirm the installed EA4 package and restart the serving runtime.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.2 · easyapache4

EasyApache 4 change log 25.91 confirms this branch update. Confirm the installed EA4 package and restart the serving runtime.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.1 · easyapache4

EasyApache 4 change log 25.91 confirms this branch update. Confirm the installed EA4 package and restart the serving runtime.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.0 · easyapache4

EasyApache 4 change log 25.91 confirms this branch update. Confirm the installed EA4 package and restart the serving runtime.

Checked at: 2026-10-22 03:28:58 UTC

PHP 7.4 · easyapache4

EasyApache 4 change log 25.91 confirms this branch update. Confirm the installed EA4 package and restart the serving runtime.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.5 · rhel

No exact fixed RHSA package was confirmed for this PHP branch. Match the RHEL product, release and module stream; confirmed fixes for other combinations do not establish this one.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.1 · rhel

No exact fixed RHSA package was confirmed for this PHP branch. Match the RHEL product, release and module stream; confirmed fixes for other combinations do not establish this one.

Checked at: 2026-10-22 08:51:47 UTC

PHP 7.4 · rhel · 8 (php:7.4 module)

RHSA-2026:87080 and its CSAF record confirm both CVEs in the RHEL 8 php:7.4 module for x86_64, aarch64, ppc64le and s390x. This PHP vulnerability backport does not establish an AlmaLinux, Rocky Linux or another module-stream fix. Installation was not tested here; the local checker still requires manual RPM advisory confirmation.

Checked at: 2026-10-22 03:29:00 UTC

PHP 7.4 · rocky-linux · Rocky Linux 8 · php:7.4

Rocky Linux 8 AppStream publishes the php:7.4 PHP vulnerability backport under RLSA-2026:87080, covering both CVEs. The x86_64 and aarch64 CLI, common and FPM RPMs were downloaded and their checksums match the official package and advisory metadata. Expand the exact revisions; this does not confirm other branches, releases or AlmaLinux. Installation and service restarts were not tested; the checker does not compare these RPM revisions automatically.

Checked at: 2026-10-22 04:44:41 UTC

PHP 8.3 · rhel · RHEL 10.2 AppStream

The linked RHSA and CSAF confirm this PHP vulnerability fix for the listed RHEL AppStream release, package family and architectures. Expand the complete revisions. Subscription CDN access and installation were not tested. Other releases, channels and distributions need separate confirmation.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.4 · rhel · RHEL 10.2 AppStream

The linked RHSA and CSAF confirm this PHP vulnerability fix for the listed RHEL AppStream release, package family and architectures. Expand the complete revisions. Subscription CDN access and installation were not tested. Other releases, channels and distributions need separate confirmation.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.2 · rhel · RHEL 9.8 AppStream · php:8.2

The linked RHSA and CSAF confirm this PHP vulnerability fix for the listed RHEL AppStream release, package family and architectures. Expand the complete revisions. Subscription CDN access and installation were not tested. Other releases, channels and distributions need separate confirmation.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.2 · rhel · RHEL 8.10 AppStream · php:8.2

The linked RHSA and CSAF confirm this PHP vulnerability fix for the listed RHEL AppStream release, package family and architectures. Expand the complete revisions. Subscription CDN access and installation were not tested. Other releases, channels and distributions need separate confirmation.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.3 · rhel · RHEL 9.8 AppStream · php:8.3

The linked RHSA and CSAF confirm this PHP vulnerability fix for the listed RHEL AppStream release, package family and architectures. Expand the complete revisions. Subscription CDN access and installation were not tested. Other releases, channels and distributions need separate confirmation.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.0 · rhel · RHEL 9.8 AppStream

The linked RHSA and CSAF confirm this PHP vulnerability fix for the listed RHEL AppStream release, package family and architectures. Expand the complete revisions. Subscription CDN access and installation were not tested. Other releases, channels and distributions need separate confirmation.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.0 · rocky-linux · Rocky Linux 9 AppStream

Rocky Linux AppStream publishes this PHP vulnerability fix for the listed release, family and architectures. Both CVEs are listed in its own RLSA. The CLI, common and FPM RPMs were downloaded and their checksums match the official metadata. Confirm the module stream where applicable; installation and restarts were not tested.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.2 · rocky-linux · Rocky Linux 9 AppStream · php:8.2

Rocky Linux AppStream publishes this PHP vulnerability fix for the listed release, family and architectures. Both CVEs are listed in its own RLSA. The CLI, common and FPM RPMs were downloaded and their checksums match the official metadata. Confirm the module stream where applicable; installation and restarts were not tested.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.3 · rocky-linux · Rocky Linux 9 AppStream · php:8.3

Rocky Linux AppStream publishes this PHP vulnerability fix for the listed release, family and architectures. Both CVEs are listed in its own RLSA. The CLI, common and FPM RPMs were downloaded and their checksums match the official metadata. Confirm the module stream where applicable; installation and restarts were not tested.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.3 · rocky-linux · Rocky Linux 10 AppStream

Rocky Linux AppStream publishes this PHP vulnerability fix for the listed release, family and architectures. Both CVEs are listed in its own RLSA. The CLI, common and FPM RPMs were downloaded and their checksums match the official metadata. Confirm the module stream where applicable; installation and restarts were not tested.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.4 · rocky-linux · Rocky Linux 10 AppStream

Rocky Linux AppStream publishes this PHP vulnerability fix for the listed release, family and architectures. Both CVEs are listed in its own RLSA. The CLI, common and FPM RPMs were downloaded and their checksums match the official metadata. Confirm the module stream where applicable; installation and restarts were not tested.

Checked at: 2026-10-22 08:51:47 UTC

PHP 7.4 · alma-linux · AlmaLinux 8 AppStream · php:7.4

AlmaLinux stable AppStream publishes this PHP vulnerability fix for the exact release, package families and architectures listed. CLI, common and FPM downloads match the official metadata. Supported branches rebase to fixed upstream releases; the PHP 7.4 RPM changelog explicitly covers both CVEs. Module artifacts were checked separately where applicable. Installation and restarts were not tested.

Checked at: 2026-10-22 16:39:41 UTC

PHP 8.2 · alma-linux · AlmaLinux 8 AppStream · php:8.2

These AlmaLinux PHP vulnerability packages rebase to the fixed upstream release. Current updateinfo does not consistently enumerate the core runtime, so its CLI, common and FPM packages and module artifacts were independently checked in the stable repository. Downloaded checksums and RPM version headers match. Installation and restarts were not tested.

Checked at: 2026-10-22 16:39:41 UTC

PHP 8.2 · alma-linux · AlmaLinux 9 AppStream · php:8.2

These AlmaLinux PHP vulnerability packages rebase to the fixed upstream release. Current updateinfo does not consistently enumerate the core runtime, so its CLI, common and FPM packages and module artifacts were independently checked in the stable repository. Downloaded checksums and RPM version headers match. Installation and restarts were not tested.

Checked at: 2026-10-22 16:39:41 UTC

PHP 8.3 · alma-linux · AlmaLinux 9 AppStream · php:8.3

AlmaLinux stable AppStream publishes this PHP vulnerability fix for the exact release, package families and architectures listed. CLI, common and FPM downloads match the official metadata. Supported branches rebase to fixed upstream releases; the PHP 7.4 RPM changelog explicitly covers both CVEs. Module artifacts were checked separately where applicable. Installation and restarts were not tested.

Checked at: 2026-10-22 16:39:41 UTC

PHP 8.3 · alma-linux · AlmaLinux 10 AppStream

AlmaLinux stable AppStream publishes this PHP vulnerability fix for the exact release, package families and architectures listed. CLI, common and FPM downloads match the official metadata. Supported branches rebase to fixed upstream releases; the PHP 7.4 RPM changelog explicitly covers both CVEs. Module artifacts were checked separately where applicable. Installation and restarts were not tested.

Checked at: 2026-10-22 16:39:41 UTC

PHP 8.4 · alma-linux · AlmaLinux 10 AppStream

AlmaLinux stable AppStream publishes this PHP vulnerability fix for the exact release, package families and architectures listed. CLI, common and FPM downloads match the official metadata. Supported branches rebase to fixed upstream releases; the PHP 7.4 RPM changelog explicitly covers both CVEs. Module artifacts were checked separately where applicable. Installation and restarts were not tested.

Checked at: 2026-10-22 16:39:41 UTC

PHP 8.5 · plesk

Plesk confirms fixed website PHP for Linux and Windows. Separate sw-engine fixes are now available in Plesk Obsidian 18.0.81 Update 4 and 18.0.80 Update 11 on both systems. Confirm the installed panel build as well as each website runtime. Installation and service restart have not been tested here.

Checked at: 2026-10-22 03:29:02 UTC

PHP 8.4 · plesk

Plesk confirms fixed website PHP for Linux and Windows. Separate sw-engine fixes are now available in Plesk Obsidian 18.0.81 Update 4 and 18.0.80 Update 11 on both systems. Confirm the installed panel build as well as each website runtime. Installation and service restart have not been tested here.

Checked at: 2026-10-22 03:29:02 UTC

PHP 8.3 · plesk

Plesk confirms fixed website PHP for Linux and Windows. Separate sw-engine fixes are now available in Plesk Obsidian 18.0.81 Update 4 and 18.0.80 Update 11 on both systems. Confirm the installed panel build as well as each website runtime. Installation and service restart have not been tested here.

Checked at: 2026-10-22 03:29:02 UTC

PHP 8.2 · plesk

Plesk confirms fixed website PHP for Linux and Windows. Separate sw-engine fixes are now available in Plesk Obsidian 18.0.81 Update 4 and 18.0.80 Update 11 on both systems. Confirm the installed panel build as well as each website runtime. Installation and service restart have not been tested here.

Checked at: 2026-10-22 03:29:02 UTC

PHP 8.1 · plesk

Plesk confirms Linux EOL PHP 7.4.33, 8.0.30 and 8.1.34 builds dated 21 October 2026 include both fixes without changing the short version. Confirm the build date and branch; the same short version built earlier is not sufficient. This does not confirm Windows EOL packages. No package-revision threshold is used by our checker.

Checked at: 2026-10-22 03:29:02 UTC

PHP 8.0 · plesk

Plesk confirms Linux EOL PHP 7.4.33, 8.0.30 and 8.1.34 builds dated 21 October 2026 include both fixes without changing the short version. Confirm the build date and branch; the same short version built earlier is not sufficient. This does not confirm Windows EOL packages. No package-revision threshold is used by our checker.

Checked at: 2026-10-22 03:29:02 UTC

PHP 7.4 · plesk

Plesk confirms Linux EOL PHP 7.4.33, 8.0.30 and 8.1.34 builds dated 21 October 2026 include both fixes without changing the short version. Confirm the build date and branch; the same short version built earlier is not sufficient. This does not confirm Windows EOL packages. No package-revision threshold is used by our checker.

Checked at: 2026-10-22 03:29:02 UTC

PHP 8.5 · aapanel

aaPanel staff announce the fixed release: App Store → Update App List → Update each installed PHP version. Verify the runtime afterwards; individual mirrors and local builds can fail. No panel installation command has been tested here.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.4 · aapanel

aaPanel staff announce the fixed release: App Store → Update App List → Update each installed PHP version. Verify the runtime afterwards; individual mirrors and local builds can fail. No panel installation command has been tested here.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.3 · aapanel

aaPanel staff announce the fixed release: App Store → Update App List → Update each installed PHP version. Verify the runtime afterwards; individual mirrors and local builds can fail. No panel installation command has been tested here.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.2 · aapanel

aaPanel staff announce the fixed release: App Store → Update App List → Update each installed PHP version. Verify the runtime afterwards; individual mirrors and local builds can fail. No panel installation command has been tested here.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.1 · aapanel

The staff announcement confirms supported branches only. No verified aaPanel backport threshold is recorded for this EOL branch.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.0 · aapanel

The staff announcement confirms supported branches only. No verified aaPanel backport threshold is recorded for this EOL branch.

Checked at: 2026-10-22 03:28:58 UTC

PHP 7.4 · aapanel

The staff announcement confirms supported branches only. No verified aaPanel backport threshold is recorded for this EOL branch.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.5 · homebrew

Formula API lists 8.5.12 and bottle artifacts for arm64_golden_gate, arm64_tahoe, arm64_sequoia, arm64_linux, x86_64_linux. Publication confirmed; installation and service restart have not been tested.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.4 · homebrew

Formula API lists 8.4.27 and bottle artifacts for arm64_golden_gate, arm64_tahoe, arm64_sequoia, arm64_linux, x86_64_linux. Publication confirmed; installation and service restart have not been tested.

Checked at: 2026-10-22 03:28:59 UTC

PHP 8.3 · homebrew

Formula API lists 8.3.36 and bottle artifacts for arm64_golden_gate, arm64_tahoe, arm64_sequoia, arm64_linux, x86_64_linux. Publication confirmed; installation and service restart have not been tested.

Checked at: 2026-10-22 03:28:59 UTC

PHP 8.2 · homebrew

Formula API lists 8.2.35 and bottle artifacts for arm64_golden_gate, arm64_tahoe, arm64_sequoia, arm64_linux, x86_64_linux. Publication confirmed; installation and service restart have not been tested.

Checked at: 2026-10-22 03:29:00 UTC

PHP 8.1 · homebrew

The formula API is checked separately from the PHP upstream release.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.0 · homebrew

The formula API is checked separately from the PHP upstream release.

Checked at: 2026-10-22 03:28:58 UTC

PHP 7.4 · homebrew

The formula API is checked separately from the PHP upstream release.

Checked at: 2026-10-22 03:28:58 UTC

PHP 8.5 · windows

Match architecture and thread-safety to your web server before replacing the runtime.

Checked at: 2026-10-22 03:28:59 UTC

PHP 8.4 · windows

Match architecture and thread-safety to your web server before replacing the runtime.

Checked at: 2026-10-22 03:28:59 UTC

PHP 8.3 · windows

Match architecture and thread-safety to your web server before replacing the runtime.

Checked at: 2026-10-22 03:28:59 UTC

PHP 8.2 · windows

Match architecture and thread-safety to your web server before replacing the runtime.

Checked at: 2026-10-22 03:28:59 UTC

PHP 8.1 · windows

Match architecture and thread-safety to your web server before replacing the runtime.

Checked at: 2026-10-22 03:28:59 UTC

PHP 8.0 · windows

Match architecture and thread-safety to your web server before replacing the runtime.

Checked at: 2026-10-22 03:28:59 UTC

PHP 7.4 · windows

Match architecture and thread-safety to your web server before replacing the runtime.

Checked at: 2026-10-22 03:28:59 UTC

PHP 8.5 · remi

Remi stable repository metadata confirms PHP vulnerability fixes for EL 8/9/10 on x86_64 and aarch64, for SCL and modular CLI, common and FPM packages. Expand the exact revisions before choosing a package. Other extensions, operating systems and installation commands have not been tested here.

Checked at: 2026-10-22 03:29:00 UTC

PHP 8.4 · remi

Remi stable repository metadata confirms PHP vulnerability fixes for EL 8/9/10 on x86_64 and aarch64, for SCL and modular CLI, common and FPM packages. Expand the exact revisions before choosing a package. Other extensions, operating systems and installation commands have not been tested here.

Checked at: 2026-10-22 03:29:00 UTC

PHP 8.3 · remi

Remi stable repository metadata confirms PHP vulnerability fixes for EL 8/9/10 on x86_64 and aarch64, for SCL and modular CLI, common and FPM packages. Expand the exact revisions before choosing a package. Other extensions, operating systems and installation commands have not been tested here.

Checked at: 2026-10-22 03:29:00 UTC

PHP 8.2 · remi

Remi stable repository metadata confirms PHP vulnerability fixes for EL 8/9/10 on x86_64 and aarch64, for SCL and modular CLI, common and FPM packages. Expand the exact revisions before choosing a package. Other extensions, operating systems and installation commands have not been tested here.

Checked at: 2026-10-22 03:29:00 UTC

PHP 8.1 · remi

Stable Remi x86_64 and aarch64 packages now contain this PHP vulnerability backport: the official package changelogs explicitly list both CVEs. CLI, common and FPM downloads were checked for the listed EL releases and SCL/module families. Installation was not tested; match the complete revision and source.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.0 · remi

Stable Remi x86_64 and aarch64 packages now contain this PHP vulnerability backport: the official package changelogs explicitly list both CVEs. CLI, common and FPM downloads were checked for the listed EL releases and SCL/module families. Installation was not tested; match the complete revision and source.

Checked at: 2026-10-22 08:51:47 UTC

PHP 7.4 · remi

Stable Remi x86_64 and aarch64 packages now contain this PHP vulnerability backport: the official package changelogs explicitly list both CVEs. CLI, common and FPM downloads were checked for the listed EL releases and SCL/module families. Installation was not tested; match the complete revision and source.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.5 · sury

Sury ARM64 PHP vulnerability fix availability depends on the exact distribution, branch and package. Confirmed combinations have checksum-verified CLI, common and FPM artifacts listed below; other combinations remain unverified. An EOL build date alone does not establish a backport.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.4 · sury

Sury ARM64 PHP vulnerability fix availability depends on the exact distribution, branch and package. Confirmed combinations have checksum-verified CLI, common and FPM artifacts listed below; other combinations remain unverified. An EOL build date alone does not establish a backport.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.3 · sury

Sury ARM64 PHP vulnerability fix availability depends on the exact distribution, branch and package. Confirmed combinations have checksum-verified CLI, common and FPM artifacts listed below; other combinations remain unverified. An EOL build date alone does not establish a backport.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.2 · sury

Sury ARM64 PHP vulnerability fix availability depends on the exact distribution, branch and package. Confirmed combinations have checksum-verified CLI, common and FPM artifacts listed below; other combinations remain unverified. An EOL build date alone does not establish a backport.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.1 · sury

Sury ARM64 PHP vulnerability fix availability depends on the exact distribution, branch and package. Confirmed combinations have checksum-verified CLI, common and FPM artifacts listed below; other combinations remain unverified. An EOL build date alone does not establish a backport.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.0 · sury

Sury ARM64 PHP vulnerability fix availability depends on the exact distribution, branch and package. Confirmed combinations have checksum-verified CLI, common and FPM artifacts listed below; other combinations remain unverified. An EOL build date alone does not establish a backport.

Checked at: 2026-10-22 08:51:47 UTC

PHP 7.4 · sury

Sury ARM64 PHP vulnerability fix availability depends on the exact distribution, branch and package. Confirmed combinations have checksum-verified CLI, common and FPM artifacts listed below; other combinations remain unverified. An EOL build date alone does not establish a backport.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.5 · cloudlinux-alt-php

CloudLinux confirms stable alt-php builds on OS 8 and 9 with these PHP vulnerability release labels: alt-php82 8.2.35-1, alt-php83 8.3.36-1, alt-php84 8.4.27-1 and alt-php85 8.5.12-1. These align the version numbers with PHP.net; earlier fixed backports, including alt-php85 8.5.11-5, already cover both CVEs. Exact per-OS RPM revisions, architectures and runtime subpackages remain unverified here. Other OS releases are outside this new build announcement. Installation was not tested.

Checked at: 2026-10-23 00:47:27 UTC

PHP 8.4 · cloudlinux-alt-php

CloudLinux confirms stable alt-php builds on OS 8 and 9 with these PHP vulnerability release labels: alt-php82 8.2.35-1, alt-php83 8.3.36-1, alt-php84 8.4.27-1 and alt-php85 8.5.12-1. These align the version numbers with PHP.net; earlier fixed backports, including alt-php85 8.5.11-5, already cover both CVEs. Exact per-OS RPM revisions, architectures and runtime subpackages remain unverified here. Other OS releases are outside this new build announcement. Installation was not tested.

Checked at: 2026-10-23 00:47:27 UTC

PHP 8.3 · cloudlinux-alt-php

CloudLinux confirms stable alt-php builds on OS 8 and 9 with these PHP vulnerability release labels: alt-php82 8.2.35-1, alt-php83 8.3.36-1, alt-php84 8.4.27-1 and alt-php85 8.5.12-1. These align the version numbers with PHP.net; earlier fixed backports, including alt-php85 8.5.11-5, already cover both CVEs. Exact per-OS RPM revisions, architectures and runtime subpackages remain unverified here. Other OS releases are outside this new build announcement. Installation was not tested.

Checked at: 2026-10-23 00:47:27 UTC

PHP 8.2 · cloudlinux-alt-php

CloudLinux confirms stable alt-php builds on OS 8 and 9 with these PHP vulnerability release labels: alt-php82 8.2.35-1, alt-php83 8.3.36-1, alt-php84 8.4.27-1 and alt-php85 8.5.12-1. These align the version numbers with PHP.net; earlier fixed backports, including alt-php85 8.5.11-5, already cover both CVEs. Exact per-OS RPM revisions, architectures and runtime subpackages remain unverified here. Other OS releases are outside this new build announcement. Installation was not tested.

Checked at: 2026-10-23 00:47:27 UTC

PHP 8.1 · cloudlinux-alt-php

CloudLinux confirms stable alt-php fixes on OS 7/8/9 and Ubuntu 22.04. OS 10 uses ELS for these branches; its alt-php 5.2 is also in stable. The temporary ELS workaround is no longer needed on OS 7/8/9. Exact alt-php package revisions and CloudLinux 6 remain unverified here; confirm both CVEs in the installed vendor changelog. Installation was not tested.

Checked at: 2026-10-22 03:29:00 UTC

PHP 8.0 · cloudlinux-alt-php

CloudLinux confirms stable alt-php fixes on OS 7/8/9 and Ubuntu 22.04. OS 10 uses ELS for these branches; its alt-php 5.2 is also in stable. The temporary ELS workaround is no longer needed on OS 7/8/9. Exact alt-php package revisions and CloudLinux 6 remain unverified here; confirm both CVEs in the installed vendor changelog. Installation was not tested.

Checked at: 2026-10-22 03:29:00 UTC

PHP 7.4 · cloudlinux-alt-php

CloudLinux confirms stable alt-php fixes on OS 7/8/9 and Ubuntu 22.04. OS 10 uses ELS for these branches; its alt-php 5.2 is also in stable. The temporary ELS workaround is no longer needed on OS 7/8/9. Exact alt-php package revisions and CloudLinux 6 remain unverified here; confirm both CVEs in the installed vendor changelog. Installation was not tested.

Checked at: 2026-10-22 03:29:00 UTC

PHP 8.5 · cloudlinux-ea-php85

CloudLinux confirms these ea-php PHP vulnerability backports in stable for OS 7/8/9/10. Expand the revisions to match your operating system and package family. These revisions do not apply to alt-php or native PHP. Architecture-specific installation was not tested here; confirm both CVE IDs in the installed vendor changelog.

Checked at: 2026-10-22 03:29:00 UTC

PHP 8.4 · cloudlinux-ea-php84

CloudLinux confirms these ea-php PHP vulnerability backports in stable for OS 7/8/9/10. Expand the revisions to match your operating system and package family. These revisions do not apply to alt-php or native PHP. Architecture-specific installation was not tested here; confirm both CVE IDs in the installed vendor changelog.

Checked at: 2026-10-22 03:29:00 UTC

PHP 8.3 · cloudlinux-ea-php83

CloudLinux confirms these ea-php PHP vulnerability backports in stable for OS 7/8/9/10. Expand the revisions to match your operating system and package family. These revisions do not apply to alt-php or native PHP. Architecture-specific installation was not tested here; confirm both CVE IDs in the installed vendor changelog.

Checked at: 2026-10-22 03:29:00 UTC

PHP 8.2 · cloudlinux-ea-php82

CloudLinux confirms these ea-php PHP vulnerability backports in stable for OS 7/8/9/10. Expand the revisions to match your operating system and package family. These revisions do not apply to alt-php or native PHP. Architecture-specific installation was not tested here; confirm both CVE IDs in the installed vendor changelog.

Checked at: 2026-10-22 03:29:00 UTC

PHP 8.1 · cloudlinux-ea-php81

CloudLinux confirms these ea-php PHP vulnerability backports in stable for OS 7/8/9/10. Expand the revisions to match your operating system and package family. These revisions do not apply to alt-php or native PHP. Architecture-specific installation was not tested here; confirm both CVE IDs in the installed vendor changelog.

Checked at: 2026-10-22 03:29:00 UTC

PHP 8.0 · cloudlinux-ea-php80

CloudLinux confirms these ea-php PHP vulnerability backports in stable for OS 7/8/9/10. Expand the revisions to match your operating system and package family. These revisions do not apply to alt-php or native PHP. Architecture-specific installation was not tested here; confirm both CVE IDs in the installed vendor changelog.

Checked at: 2026-10-22 03:29:00 UTC

PHP 7.4 · cloudlinux-ea-php74

CloudLinux confirms these ea-php PHP vulnerability backports in stable for OS 7/8/9/10. Expand the revisions to match your operating system and package family. These revisions do not apply to alt-php or native PHP. Architecture-specific installation was not tested here; confirm both CVE IDs in the installed vendor changelog.

Checked at: 2026-10-22 03:29:00 UTC

PHP 8.2 · cloudlinux-native-php · CloudLinux 9 · native PHP

CloudLinux confirms these native PHP vulnerability fixes in stable: PHP 8.2.35 or PHP 8.3.36 for the listed branch. These builds were rebased, so the changelog may say only rebase and omit both CVE IDs; verify the installed version instead. Exact RPM revisions and architecture coverage remain unverified here. Keep native PHP separate from alt-php and ea-php.

Checked at: 2026-10-22 12:43:38 UTC

PHP 8.3 · cloudlinux-native-php · CloudLinux 9 · native PHP

CloudLinux confirms these native PHP vulnerability fixes in stable: PHP 8.2.35 or PHP 8.3.36 for the listed branch. These builds were rebased, so the changelog may say only rebase and omit both CVE IDs; verify the installed version instead. Exact RPM revisions and architecture coverage remain unverified here. Keep native PHP separate from alt-php and ea-php.

Checked at: 2026-10-22 12:43:38 UTC

PHP 8.2 · cloudlinux-native-php · CloudLinux 8 · native PHP

CloudLinux confirms these native PHP vulnerability fixes in stable: PHP 8.2.35 or PHP 8.3.36 for the listed branch. These builds were rebased, so the changelog may say only rebase and omit both CVE IDs; verify the installed version instead. Exact RPM revisions and architecture coverage remain unverified here. Keep native PHP separate from alt-php and ea-php.

Checked at: 2026-10-22 12:43:38 UTC

PHP 8.3 · cloudlinux-native-php · CloudLinux 10 · native PHP

CloudLinux confirms these native PHP vulnerability fixes in stable: PHP 8.2.35 or PHP 8.3.36 for the listed branch. These builds were rebased, so the changelog may say only rebase and omit both CVE IDs; verify the installed version instead. Exact RPM revisions and architecture coverage remain unverified here. Keep native PHP separate from alt-php and ea-php.

Checked at: 2026-10-22 20:48:24 UTC

PHP 8.0 · cloudlinux-native-php · CloudLinux 9 · native PHP

CloudLinux now confirms this native PHP vulnerability fix in the stable channel. It supersedes the earlier beta or incomplete rollout notice and covers both CVEs. These branches use vendor backports: confirm both CVE IDs in the installed vendor changelog. Exact RPM revisions and architecture coverage remain unverified here; installation and restarts were not tested.

Checked at: 2026-10-22 20:48:24 UTC

PHP 8.1 · cloudlinux-native-php · CloudLinux 9 · native PHP

CloudLinux now confirms this native PHP vulnerability fix in the stable channel. It supersedes the earlier beta or incomplete rollout notice and covers both CVEs. These branches use vendor backports: confirm both CVE IDs in the installed vendor changelog. Exact RPM revisions and architecture coverage remain unverified here; installation and restarts were not tested.

Checked at: 2026-10-22 20:48:24 UTC

PHP 7.2 · cloudlinux-native-php · CloudLinux 8 · native PHP

CloudLinux now confirms this native PHP vulnerability fix in the stable channel. It supersedes the earlier beta or incomplete rollout notice and covers both CVEs. These branches use vendor backports: confirm both CVE IDs in the installed vendor changelog. Exact RPM revisions and architecture coverage remain unverified here; installation and restarts were not tested.

Checked at: 2026-10-22 20:48:24 UTC

PHP 7.3 · cloudlinux-native-php · CloudLinux 8 · native PHP

CloudLinux now confirms this native PHP vulnerability fix in the stable channel. It supersedes the earlier beta or incomplete rollout notice and covers both CVEs. These branches use vendor backports: confirm both CVE IDs in the installed vendor changelog. Exact RPM revisions and architecture coverage remain unverified here; installation and restarts were not tested.

Checked at: 2026-10-22 20:48:24 UTC

PHP 7.4 · cloudlinux-native-php · CloudLinux 8 · native PHP

CloudLinux now confirms this native PHP vulnerability fix in the stable channel. It supersedes the earlier beta or incomplete rollout notice and covers both CVEs. These branches use vendor backports: confirm both CVE IDs in the installed vendor changelog. Exact RPM revisions and architecture coverage remain unverified here; installation and restarts were not tested.

Checked at: 2026-10-22 20:48:24 UTC

PHP 8.0 · cloudlinux-native-php · CloudLinux 8 · native PHP

CloudLinux now confirms this native PHP vulnerability fix in the stable channel. It supersedes the earlier beta or incomplete rollout notice and covers both CVEs. These branches use vendor backports: confirm both CVE IDs in the installed vendor changelog. Exact RPM revisions and architecture coverage remain unverified here; installation and restarts were not tested.

Checked at: 2026-10-22 20:48:24 UTC

PHP 5.4 · cloudlinux-tuxcare-els-php · CloudLinux 7 · TuxCare ELS PHP

CloudLinux now lists the OS 7 PHP 5.4 PHP vulnerability fix in stable as a TuxCare ELS package. Keep this family separate from native PHP, alt-php and ea-php. Exact ELS package revisions, entitlement and architecture coverage remain unverified here; installation was not tested.

Checked at: 2026-10-22 20:48:24 UTC

PHP 8.5 · amazon-linux

Amazon Linux 2023 security tracker lists Pending Fix for this branch for both CVEs.

Checked at: 2026-10-22 03:29:00 UTC

PHP 8.4 · amazon-linux

Amazon Linux 2023 security tracker lists Pending Fix for this branch for both CVEs.

Checked at: 2026-10-22 03:29:00 UTC

PHP 8.3 · amazon-linux

Amazon Linux 2023 security tracker lists Pending Fix for this branch for both CVEs.

Checked at: 2026-10-22 03:29:00 UTC

PHP 8.2 · amazon-linux

Amazon Linux 2023 security tracker lists Pending Fix for this branch for both CVEs.

Checked at: 2026-10-22 03:29:00 UTC

PHP 8.1 · amazon-linux

Amazon Linux 2023 tracker explicitly lists No Fix Planned for this branch.

Checked at: 2026-10-22 03:29:00 UTC

PHP 8.0 · amazon-linux

This branch is not confirmed by the checked Amazon Linux 2023 table.

Checked at: 2026-10-22 03:29:00 UTC

PHP 7.4 · amazon-linux

This branch is not confirmed by the checked Amazon Linux 2023 table.

Checked at: 2026-10-22 03:29:00 UTC

PHP 8.5 · bt · Linux / Windows

BT confirms PHP vulnerability fixes for PHP 8.2–8.5 on its Linux and Windows panels. Refresh the software list and update each website runtime. Panel installation and restart have not been tested here.

Checked at: 2026-10-22 04:34:40 UTC

PHP 8.4 · bt · Linux / Windows

BT confirms PHP vulnerability fixes for PHP 8.2–8.5 on its Linux and Windows panels. Refresh the software list and update each website runtime. Panel installation and restart have not been tested here.

Checked at: 2026-10-22 04:34:40 UTC

PHP 8.3 · bt · Linux / Windows

BT confirms PHP vulnerability fixes for PHP 8.2–8.5 on its Linux and Windows panels. Refresh the software list and update each website runtime. Panel installation and restart have not been tested here.

Checked at: 2026-10-22 04:34:40 UTC

PHP 8.2 · bt · Linux / Windows

BT confirms PHP vulnerability fixes for PHP 8.2–8.5 on its Linux and Windows panels. Refresh the software list and update each website runtime. Panel installation and restart have not been tested here.

Checked at: 2026-10-22 04:34:40 UTC

PHP 8.1 · bt · Linux

BT confirms PHP vulnerability backports for PHP 7.4, 8.0 and 8.1 on Linux only. Its 7.4.34, 8.0.31 and 8.1.35 labels are BT Linux packages, not upstream releases. Do not apply those labels to BT Windows or another vendor. Confirm the updated build in the panel; installation has not been tested here.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.0 · bt · Linux

BT confirms PHP vulnerability backports for PHP 7.4, 8.0 and 8.1 on Linux only. Its 7.4.34, 8.0.31 and 8.1.35 labels are BT Linux packages, not upstream releases. Do not apply those labels to BT Windows or another vendor. Confirm the updated build in the panel; installation has not been tested here.

Checked at: 2026-10-22 08:51:47 UTC

PHP 7.4 · bt · Linux

BT confirms PHP vulnerability backports for PHP 7.4, 8.0 and 8.1 on Linux only. Its 7.4.34, 8.0.31 and 8.1.35 labels are BT Linux packages, not upstream releases. Do not apply those labels to BT Windows or another vendor. Confirm the updated build in the panel; installation has not been tested here.

Checked at: 2026-10-22 08:51:47 UTC

PHP 8.1 · bt · Windows

BT has not announced fixed PHP vulnerability packages for PHP 8.1 or earlier on its Windows panel. The vendor describes session-upload-progress mitigation for CVE-2026-109619; it does not fix CVE-2026-109618. Plan a move to a supported, fixed branch. Linux backport package labels do not establish a Windows fix.

Checked at: 2026-10-22 04:34:40 UTC

PHP 8.0 · bt · Windows

BT has not announced fixed PHP vulnerability packages for PHP 8.1 or earlier on its Windows panel. The vendor describes session-upload-progress mitigation for CVE-2026-109619; it does not fix CVE-2026-109618. Plan a move to a supported, fixed branch. Linux backport package labels do not establish a Windows fix.

Checked at: 2026-10-22 04:34:40 UTC

PHP 7.4 · bt · Windows

BT has not announced fixed PHP vulnerability packages for PHP 8.1 or earlier on its Windows panel. The vendor describes session-upload-progress mitigation for CVE-2026-109619; it does not fix CVE-2026-109618. Plan a move to a supported, fixed branch. Linux backport package labels do not establish a Windows fix.

Checked at: 2026-10-22 04:34:40 UTC

PHP 7.0 · bt · Linux

BT confirms Linux PHP vulnerability backports for PHP 7.0-7.3, based on its adaptation of the PHP 7.4 security patches. The repair versions are BT builds, not new upstream releases. Official download locations respond, but panel installation and restarts were not tested here. These packages do not confirm a Windows fix.

Checked at: 2026-10-22 12:43:38 UTC

PHP 7.1 · bt · Linux

BT confirms Linux PHP vulnerability backports for PHP 7.0-7.3, based on its adaptation of the PHP 7.4 security patches. The repair versions are BT builds, not new upstream releases. Official download locations respond, but panel installation and restarts were not tested here. These packages do not confirm a Windows fix.

Checked at: 2026-10-22 12:43:38 UTC

PHP 7.2 · bt · Linux

BT confirms Linux PHP vulnerability backports for PHP 7.0-7.3, based on its adaptation of the PHP 7.4 security patches. The repair versions are BT builds, not new upstream releases. Official download locations respond, but panel installation and restarts were not tested here. These packages do not confirm a Windows fix.

Checked at: 2026-10-22 12:43:38 UTC

PHP 7.3 · bt · Linux

BT confirms Linux PHP vulnerability backports for PHP 7.0-7.3, based on its adaptation of the PHP 7.4 security patches. The repair versions are BT builds, not new upstream releases. Official download locations respond, but panel installation and restarts were not tested here. These packages do not confirm a Windows fix.

Checked at: 2026-10-22 12:43:38 UTC