PHP2Shell leaves servers on PHP versions with no official fix
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Official fixes for the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) cover PHP 8.2 to 8.5, while older branches got only minimal source backports for 7.4, 8.0 and 8.1, and nothing for 5.6 or 7.3 and earlier. A Shodan count put about 884,000 hosts, 59% of those exposing a version, on unsupported releases. These are banner counts, not confirmed vulnerable sites, and distributions may patch under old version strings. Check vendor changelogs for both CVE IDs, and plan a move to 8.4 or 8.5.