https://reddit.com/r/sysadmin/comments/1xhlwau/php2shell_is_in_cisa_kev_with_a_federal_deadline/: php2shell is in CISA KEV with a federal deadline tomorrow (Oct 29): fixed PHP is 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, and the patch does not take effect until the workers restart

Q: How can I verify that the vulnerable PHP runtime has actually been replaced?

Check the PHP build loaded by the web server rather than relying on the command-line php -v output, which may reference a different installation. A phpinfo page served through the web server or PHP-FPM pool status can show the active build.

Q: Is installing the fixed PHP package enough to remediate the issue?

No. The PHP workers must also be restarted for the patched runtime to take effect, including deployments using Apache mod_php, PHP-FPM, php-cgi, or another SAPI.

Q: What should organizations running PHP 8.1 or older do?

PHP 8.1 and older do not receive a fix. Upgrade to a supported branch, obtain a vendor backport, or take systems that cannot be updated offline until remediation is possible.

Published Oct 28, 2026

Updated

Affected Software

1 affected component

PHP Group PHP>=8.2.0<8.2.35, >=8.3.0<8.3.36, >=8.4.0<8.4.27, >=8.5.0<8.5.12

Frequently Asked Questions

How can I verify that the vulnerable PHP runtime has actually been replaced?

Check the PHP build loaded by the web server rather than relying on the command-line php -v output, which may reference a different installation. A phpinfo page served through the web server or PHP-FPM pool status can show the active build.

Is installing the fixed PHP package enough to remediate the issue?

No. The PHP workers must also be restarted for the patched runtime to take effect, including deployments using Apache mod_php, PHP-FPM, php-cgi, or another SAPI.

What should organizations running PHP 8.1 or older do?

PHP 8.1 and older do not receive a fix. Upgrade to a supported branch, obtain a vendor backport, or take systems that cannot be updated offline until remediation is possible.

https://reddit.com/r/sysadmin/comments/1xhlwau/php2shell_is_in_cisa_kev_with_a_federal_deadline/: php2shell is in CISA KEV with a federal deadline tomorrow (Oct 29): fixed PHP is 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, and the patch does not take effect until the workers restart

Affected Software

Frequently Asked Questions

How can I verify that the vulnerable PHP runtime has actually been replaced?

Is installing the fixed PHP package enough to remediate the issue?

What should organizations running PHP 8.1 or older do?

Company

Resources

Contact

Frequently Asked Questions

How can I verify that the vulnerable PHP runtime has actually been replaced?

Is installing the fixed PHP package enough to remediate the issue?

What should organizations running PHP 8.1 or older do?