This page summarizes publicly available information on options for end-of-life PHP versions, including backported security fixes. It is shared for information only. We do not provide, build, distribute or support any PHP patch or patched PHP build, and we have not tested, verified or endorsed the approaches or sources linked here. Information may change; confirm details with the linked sources and your own vendors. We recommend reviewing any approach with your own team and testing it before use in production.
Background and preferred approaches
Why: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a critical remote code execution issue, and the PHP project shipped fixed releases only for supported branches.
Preferred: upgrade to a supported, fixed PHP release, or use patched packages from your operating-system or long-term-support vendor. Backporting is a fallback for when neither is possible.
Backporting: what the industry is doing
Backporting means applying a security fix to an older PHP version instead of upgrading. For PHP2Shell, the PHP security team published minimal source backports for PHP 7.4, 8.0 and 8.1, intended for people who build PHP from source or have no LTS vendor. These are patches, not official PHP releases.
| Approach seen | In brief | Where to look |
|---|---|---|
| PHP's own source backports | Branches in the official php-src repository, each holding one fix commit for an end-of-life version. | PHP advisory; see the patch table below |
| Building PHP from source with the patch | Teams that compile PHP apply the backport to the matching source and rebuild, following PHP's build documentation. | php.net: Installing from source |
| Rebuilding the distribution's PHP package | Teams that use packaged PHP add the backport to their distribution's source package and rebuild it, so it stays under the package manager. | Your OS vendor's packaging documentation |
| Vendor-supplied backports | Some distributions and LTS vendors have shipped backported fixes, so no self-build is needed. | Your OS or LTS vendor |
PHP security team backport patches
All three are in PHP's official GitHub repository, authored by a PHP core developer, as a single commit titled "Avoid state corruption via bailout" on top of each end-of-life branch.
| PHP version | Branch | Fix commit | Patch file |
|---|---|---|---|
| 8.1 | PHP-8.1-CVE-2026-109618-109619 | 1d7dec17 | 1d7dec17.patch |
| 8.0 | PHP-8.0-CVE-2026-109618-109619 | 82f8f31b | 82f8f31b.patch |
| 7.4 | PHP-7.4-CVE-2026-109618-109619 | 712e60f9 | 712e60f9.patch |
Each branch is based on the final state of its end-of-life branch, not exactly on the last numbered release, so confirm the patch applies cleanly to the source you build from.
Points commonly raised
- The backports are described as minimal and may not be equivalent to the fixes in supported releases.
- A backported build still reports its original PHP version, so version-based scanners may keep flagging it.
- Whoever builds the patched PHP becomes responsible for maintaining it.
- Check with your application vendor before changing the PHP runtime.
- Restart all PHP worker processes after any change; running workers keep the old code.
- Treat backporting as a bridge, with a plan to move to a supported PHP release.
Sources
Official PHP sources take precedence over any other reference.
Official
- PHP security advisory, 21 October 2026
- PHP security bulletin GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
- PHP security bulletin GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
- PHP supported versions
Backporting and packaging references
Third-party write-ups on installing the backport
Independent articles, not reviewed or endorsed by us; check them against the official sources above.
- ComputingForGeeks: PHP2Shell on end-of-life PHP 8.1, 8.0 and 7.4: where to get backported packages for common platforms and how to verify the fix is installed.
- Safeguard: PHP2Shell on end-of-life PHP 7.4, 8.0 and 8.1, your options: walks through building PHP's official source backport, including testing, rollback and recording proof of the fix.