Ubuntu published PHP2Shell fixes on October 21 for operating system releases running PHP branches as old as 5.5, while Debian issued updates for Debian 13 and Debian 12. The package notices, checked on October 22, give administrators several routes to patching older applications, depending on their operating system release and maintenance coverage. Ubuntu's older-release notice; Debian 13 advisory; Debian 12 advisory.

PHP runs website application code on a server. The two flaws, identified as CVE-2026-109618 and CVE-2026-109619 and commonly called PHP2Shell, can let an attacker run code remotely without logging in. PHP's own October 21 announcement directed users of distribution packages to their suppliers and noted that some vendors maintain fixes for branches that no longer receive regular upstream updates. PHP project security announcement.

An administrator using Ubuntu's PHP 8.1 package on Ubuntu 22.04 has a named distribution fix, even though PHP 8.1 is outside regular upstream maintenance. An administrator using a different supplier's PHP 8.1 build needs that supplier's answer. Ubuntu Security Notice USN-8948-1.

Ubuntu names fixes from 14.04 through 26.10

Ubuntu divided its response between two notices dated October 21. USN-8948-1 covers 22.04, 24.04, 26.04 and 26.10. USN-8948-2 lists the corresponding fixes for 20.04, 18.04, 16.04 and 14.04, with the older builds marked for Ubuntu Pro. The notice adds a Legacy Support requirement for 16.04 and 14.04.

Ubuntu Pro is Canonical's extended maintenance service. Expanded Security Maintenance, or ESM, supplies updates beyond standard maintenance periods. Its Legacy add-on extends that maintenance further. Canonical's release-cycle table places Ubuntu 20.04 and 18.04 in their extended-maintenance periods and Ubuntu 16.04 and 14.04 beyond their ordinary ten-year periods. Ubuntu release and support calendar; Ubuntu Pro service description.

Canonical stated the distinction in its Ubuntu security blog post dated October 21: Ubuntu 16.04 LTS and 14.04 LTS require ESM with the Legacy add-on. The same post places 20.04 and 18.04 under ESM and the four newer releases under standard support for these fixes. Canonical's PHP2Shell response.

Ubuntu package builds named in the October 21 notices, checked October 22
Ubuntu releasePHP source packageBuild correcting these two issuesRoute stated by Canonical
26.10php8.58.5.9-0ubuntu2.1Standard support
26.04 LTSphp8.58.5.4-0ubuntu1.5Standard support
24.04 LTSphp8.38.3.6-0ubuntu0.24.04.13Standard support
22.04 LTSphp8.18.1.2-1ubuntu2.28Standard support
20.04 LTSphp7.47.4.3-4ubuntu2.29+esm5Ubuntu Pro / ESM
18.04 LTSphp7.27.2.24-0ubuntu0.18.04.17+esm14Ubuntu Pro / ESM
16.04 LTSphp7.07.0.33-0ubuntu0.16.04.16+esm22Ubuntu Pro with Legacy Support add-on
14.04 LTSphp55.5.9+dfsg-1ubuntu4.29+esm18Ubuntu Pro with Legacy Support add-on

Builds come from USN-8948-1 and USN-8948-2; support routes also follow Canonical's accompanying post. Each notice lists affected binary packages, including the PHP-FPM and command-line packages where applicable. This table groups them by source package; administrators still need to check the installed binary packages.

For an organization staying on an older Ubuntu release, receiving the fix can therefore depend on confirming an existing entitlement or arranging the appropriate maintenance coverage. The notices do not supply a universal subscription price. They identify which packages and support route apply, leaving procurement and deployment details to the organization's actual setup.

Debian publishes separate stable and long-term updates

Debian's October 21 stable-security advisory, DSA-6574-1, identifies php8.4 version 8.4.27-1~deb13u1 as the fix for Debian 13, known as trixie. The notice covers both CVEs and recommends upgrading the affected packages. Its mailing-list header is dated 13:45 UTC that day. Debian stable advisory.

The Debian LTS team separately issued DLA-4848-1 for Debian 12, known as bookworm, naming php8.2 version 8.2.35-1~deb12u1. That message is dated 16:11 at UTC+02:00, or 14:11 UTC, on October 21. These are announcement timestamps; they do not measure when a particular mirror, hosting provider or customer server received the packages. Debian long-term support advisory.

Both Debian CVE pages, reopened for this report on October 22, mark the trixie-security and bookworm-security builds above as fixed. They also distinguish those security builds from older versions still listed under each release's base package row. The tracker describes source packages; website operators must connect that status to their installed packages. Debian tracker for CVE-2026-109618; Debian tracker for CVE-2026-109619.

Bookworm's update came through an established maintenance handover. In a July 12 announcement, Debian said its LTS team had taken over security support for Debian 12 and would maintain it until June 30, 2028. That announcement also warns that some packages fall outside LTS coverage and identifies a limited set of supported computer architectures. Debian's LTS service uses a separate team from its regular security team. Debian's July support handover; How Debian LTS is organized.

An administrator with several Debian releases needs to track the stable and LTS notices appropriate to each installation.

The package revision changes what a version check means

Ubuntu's fixed 24.04 build still begins with 8.3.6, and its fixed 22.04 build begins with 8.1.2. Those numbers can look behind a newer PHP release while the complete Ubuntu revision identifies a patched build. Debian and Ubuntu maintain stable packages by bringing selected security fixes into their existing software, a process called backporting. Ubuntu's listed revisions; Debian's explanation of security backports.

That gives administrators two different maintenance tasks. They can apply a supplier's fix within an existing package branch when one is provided. Moving an application to a newer PHP branch is a broader change that may require compatibility work. A vendor's package fix addresses the named issues within its scope; it does not restart upstream maintenance for that old branch. PHP's announcement expressly directs older-version users to vendor backports or an upgrade. PHP's vendor and older-version guidance.

Deploying the package also requires attention to running applications. Canonical's October 21 post says affected applications still need to be restarted after automated package installation, with Apache's PHP module given as an example. The publication of a corrected build therefore establishes a supplier's update, while confirmation that an application uses it requires evidence from the server or hosting operator. Canonical's deployment guidance.

For a site owner asking a host about the update, useful details are the operating system release, PHP package supplier, full installed revision, advisory reference and confirmation about the web runtime. Our separate guide to package backports and running PHP processes explains that check. The free PHPFixes version tool compares entered text and does not inspect a host or establish deployment status.

Debian's testing release still had an affected build

Debian's October 22 tracker still marked php8.4 version 8.4.26-1 in forky as vulnerable to both CVEs. It marked 8.4.27-1 in sid as fixed. Those rows sit alongside the fixed stable and LTS security builds. Forky is Debian's testing release; sid is its unstable development release. First CVE's release table; second CVE's release table; Debian release definitions.

Users of forky had a remaining release-specific status to follow when these records were checked. The next relevant change for that group is a corrected build in their release and an updated tracker row; the stable and LTS advisories already name the builds for trixie and bookworm.

Reporting sources