php2shell Patches Are Available Now for PHP 5.2 Through 8.5

ELS for PHP is part of ELS for Runtimes, which covers PHP and all other runtimes. Prices:

• Up to 10 licenses: $5,000 per year.
• 11 to 100 licenses: $9,750 per year.

Annual term, paid in advance, no setup fee.

Buy online: https://tuxcare.com/buy/els/?family=rt

No. TuxCare has no single licenses and no monthly plans. The smallest tier is up to 10 licenses for $5,000 per year.

Buy online: https://tuxcare.com/buy/els/?family=rt

Yes. The license is per server. It covers every supported PHP version on that server (for example 7.0, 7.1, 7.2 and 7.3 together) and every domain hosted on it.

Yes, for non-system PHP versions. ELS for CentOS 6 or 7 does not give access to the alt-php repository. The alt-php builds need an ELS for Runtimes license that supports all the different versions of PHP, like PHP 7.

The native OS PHP packages (for example, CentOS 7 php-5.4.16) get fixes through ELS for OS.

Buy: https://tuxcare.com/buy/els/?family=rt (choose ELS for Runtimes; PHP is included). A welcome email sends the license key and the install instructions.

Install: follow https://docs.tuxcare.com/els-for-runtimes/php/ (opens in new tab)

Install errors (for example "No token was returned from CLN"): open a support ticket at https://support.tuxcare.com/hc/en-us/requests/new (opens in new tab). Give the OS, the PHP version, the exact error text and your license key ID.

Online purchase: the welcome email sends the license key right after purchase.

Purchase order: payment is in advance. The license key is sent after the payment is processed.

The install uses the package manager and needs no downtime.

We don't provide trial licenses at the moment.

Japan: Cybertrust (https://www.cybertrust.co.jp/ (opens in new tab)) gives local purchase, local pricing and Japanese support.

South Korea: CUDO Communication (https://www.cudo.co.kr/ (opens in new tab))

Yes. Engineering backported the fixes to every alt-php branch: 5.2–5.6, 7.0–7.4 and 8.0–8.5.

Upstream PHP fixed only 8.2.35, 8.3.36, 8.4.27 and 8.5.12. For older branches, the fix comes from TuxCare.

PHP 8.1 and older got no release from the PHP project. PHP's security team published minimal source backports for 7.4, 8.0 and 8.1. PHP 8.2 reaches end of life on December 31, 2026.

A fixed build keeps the old PHP version and gets a new release number. Example: alt-php74 stays at 7.4.33 and changes from release -79 to -81 on EL7.

To check one branch and OS, use the CVE tracker: CVE-2026-109618 and CVE-2026-109619

On ELS for OS platforms, the native OS PHP packages also got the fix. Examples: Ubuntu 16.04/18.04/20.04, Debian 10/11, CentOS 6/7/8, RHEL 7, Amazon Linux 2.

PHP's advisory names PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Apache mod_php carries the highest risk. PHP-FPM, LiteSpeed and FrankenPHP are affected in some configurations. PHP states that updating is the only complete solution.

We support PHP 5.2 through 8.5. The PHP versions available depend on the OS:

Linux

• EL6 (CentOS 6, Oracle Linux 6, CloudLinux 6): PHP 5.2–5.6, 7.0–7.4, 8.0–8.3
• EL7 (CentOS 7, RHEL 7, Oracle Linux 7, Amazon Linux 2, CloudLinux 7): PHP 5.2–5.6, 7.0–7.4, 8.0–8.5
• EL8 (AlmaLinux, Rocky Linux, RHEL, Oracle Linux, CentOS 8, CentOS Stream 8, CloudLinux): PHP 5.2–5.6, 7.0–7.4, 8.0–8.5
• EL9 (AlmaLinux, Rocky Linux, RHEL, Oracle Linux, CentOS Stream 9, CloudLinux): PHP 5.2–5.6, 7.0–7.4, 8.0–8.5
• EL10 (AlmaLinux, Rocky Linux, RHEL, Oracle Linux, CloudLinux): PHP 5.3–5.6, 7.0–7.4, 8.0–8.5
• Ubuntu 16.04: PHP 5.5, 5.6, 7.0–7.4, 8.0–8.3
• Ubuntu 18.04, 20.04, 22.04, 24.04: PHP 5.2, 5.6, 7.0–7.4, 8.0–8.5
• Ubuntu 26.04: PHP 5.6, 7.0–7.4, 8.0–8.5
• Debian 10, 11, 12: PHP 5.6, 7.0–7.4, 8.0–8.5
• Debian 13: PHP 5.2–5.6, 7.0–7.4, 8.0–8.5
• Alpine Linux 3.23, 3.24: PHP 7.3, 7.4, 8.0, 8.1

Windows

• Windows Server 2019, 2022, 2025 (x64 and x86): PHP 5.2, 5.4, 5.6, 7.2, 7.3, 7.4, 8.0, 8.1, 8.2

Windows Server 2016 and older are not on this list, and neither are PHP 5.3, 5.5, 7.0 and 7.1 for Windows.

Full table: https://docs.tuxcare.com/els-for-runtimes/php/#about-alt-php (opens in new tab)

Architecture: x86_64 on all Linux systems. arm64 on Debian 12 and 13 and on Alpine Linux. Other versions and architectures are available on request.

End-of-life OS: CentOS 6, 7 and 8, CentOS Stream 8, RHEL 7, Oracle Linux 6 and 7, Amazon Linux 2, Ubuntu 16.04, 18.04 and 20.04, and Debian 10 and 11 are end of life. ELS for PHP fixes only PHP. For security fixes to the OS itself, buy ELS for the OS too: https://tuxcare.com/buy/els/ (OS list: https://docs.tuxcare.com/els-for-os/ (opens in new tab)). One order can include both products.

Not supported: Amazon Linux 1, CentOS 5, Debian 9, SUSE, and 32-bit CentOS 6.

Amazon Linux 2023 isn't in the ELS for PHP supported OS list. It isn't on the ELS roadmap today, and TuxCare plans to add it to the roadmap if there is enough demand. Amazon Linux 2023 reaches end of support in June 2029.

ELS for Runtimes covers PHP 5.2 through 8.5 and includes 24/7 technical support. The support is Endless. We don't plan to retire any of the PHP versions within the next several years.

TuxCare makes commercially reasonable efforts to provide patches within these times, counted from the date a vulnerability is publicly disclosed:

• Critical and high risk (CVSS 7.0 and above): within 14 days
• Medium risk (CVSS 4.0 to 6.9): within 60 days
• Low risk (CVSS 0.1 to 3.9): within 90 days

We delivered fixes for these two critical CVEs on the same day. Full terms: https://docs.tuxcare.com/els-for-runtimes/ (opens in new tab)

It installs next to your current PHP. ELS for PHP installs its own builds (alt-php) from the TuxCare repository into /opt/alt/phpXY. These builds run separately from the system PHP, Remi, Sury, Webtatic, IUS, ea-php, Plesk PHP or a custom build.

You move sites to alt-php one at a time. To roll back, switch the site back to the old PHP.

The install uses the package manager and needs no downtime.

TuxCare does not patch Amazon builds or self-compiled PHP. You move the site to the alt-php build of the same branch.

On cPanel, the change from ea-php73 to alt-php73 is a per-account PHP version selection. Test on one account or on a staging copy first.

Yes, it works with cPanel, with Plesk, and with no control panel.

No panel / other panels: a standard Apache setup is enough. No control panel is necessary. We cannot provide details on each control panel or on older versions of control panels.

cPanel: ELS for PHP works on CentOS 7 with cPanel/WHM 110. Install the packages, then switch the sites to the alt-php version of the same branch. The cPanel Store TuxCare ELS for PHP subscription delivers the same fixes.

Plesk: alt-php shows in Plesk as an extra PHP handler next to the Plesk PHP versions. You switch only the sites you select. The TuxCare PHP extension for Plesk needs Plesk 18.0.72 or later.

Most common extensions are included. alt-php ships extensions as separate packages. The supported list: https://docs.tuxcare.com/els-for-runtimes/php/#supported-os-and-php-versions (opens in new tab)

For alt-php73 on cPanel, ionCube, OPcache, memcached, GD, intl and the MySQL drivers are available.

For an unusual stack, send us the output of php -v and php -m and a list of your PECL or ionCube modules. Our engineers will confirm what is available.

Some PECL extensions ship as alt-php packages, such as alt-phpXY-pecl-msgpack and alt-phpXY-pecl-igbinary. You can also install extensions with pecl. The ELS for PHP docs (opens in new tab) show how to build an extension for alt-php with phpize and the alt-phpXY-devel package, using SaxonC as the example.

Standard alt-php builds are not compiled with thread safety. alt-php72 on EL7 also has a thread-safe package, alt-php72-zts, which provides a zts-php binary. Thread-safe builds of other versions are made on request. Each one is a separate build of PHP and of its PECL extensions, about 75 packages per PHP version, so contact sales for a quote.

Update the alt-php packages with your system's regular update tool (yum, dnf or apt). The updated build installs under /opt/alt/phpXY. You can check which release fixes your PHP branch and OS in the TuxCare CVE tracker.

TuxCare doesn't patch Remi packages today. alt-php installs next to Remi's PHP, under /opt/alt/phpXY, and you move sites to it one at a time. For example, alt-php74 can be installed on Rocky Linux 9.

arm64 packages are available for Debian 12 and 13 and for Alpine Linux 3.23 and later. The Debian install script, install-els-alt-php-deb-repo.sh, sets up the repository in Debian 12 and 13 containers on amd64 and arm64. Run it with bash, because running it with sh produces errors. Licensing for containers is arranged separately, so contact sales.

Yes, if sales approves it. Sales can add your IP addresses to the rsync allowlist. TuxCare repositories always use token-based or IP-based authentication.

TuxCare has source packages for ELS for PHP: src.rpm packages for Enterprise Linux and source tarballs for Debian and Ubuntu. They are provided to customers on request.

These builds fix CVE-2026-109618 and CVE-2026-109619:

• PHP 5.2.17: tuxcare.els9
• PHP 5.4.45: tuxcare.els8
• PHP 5.6.40: tuxcare.els12
• PHP 7.2.34: tuxcare.els9
• PHP 7.3.33: tuxcare.els11
• PHP 7.4.33: tuxcare.els13
• PHP 8.0.30: tuxcare.els8
• PHP 8.1.33: tuxcare.els6
• PHP 8.2.29: tuxcare.els4

Any build with that els number or higher contains the fix. All builds are at windows.tuxcare.com/php/<version>/.

• PHP 5.2 and 5.4: x86 only, VC9
• PHP 5.6: x86 and x64, VC11
• PHP 7.2, 7.3 and 7.4: x86 and x64, VC15
• PHP 8.0, 8.1 and 8.2: x86 and x64, vs16

Every version comes in thread-safe (TS) and non-thread-safe (NTS) builds. PHP 5.2 can only be built as x86, so there is no x64 build of it.

You need Administrator access and either a TuxCare license key or the authentication token you already have. You can install with the TuxCare Installer (recommended), the tuxcare-installer.ps1 PowerShell script, or a manual download. The installer installs one PHP version per run.

If PHP is already installed, you choose Replace, which removes the previous installations, or Alongside, which keeps them. The installer creates php.ini from php.ini-production, adds the PHP folder to the system Path and removes other PHP folders from the Path.

Some extensions are marked TS only or NTS only and work only with the matching build. For IIS, the docs point to the official PHP documentation. If the installer shows "(Not Authenticated)", your license or token doesn't cover PHP. The installer moves uninstalled PHP folders to %APPDATA%\TuxCareInstaller\Backups, so you can restore a version you removed by mistake.

Yes. Download tuxcare-installer.ps1 from windows.tuxcare.com, using the link in the ELS for PHP docs (opens in new tab), and run it from an elevated prompt. For automation, use -ExecutionPolicy Bypass; otherwise the signed script shows a one-time publisher prompt under RemoteSigned. One command registers the server, saves the token and installs PHP:

powershell.exe -NoProfile -ExecutionPolicy Bypass -File tuxcare-installer.ps1 -LicenseKey <license key> -Product php -Install "<archive name>" -InstallFolder D:\PHP -Modules curl,mbstring,openssl -NoPath

• Pick the archive by its file name, exactly as -List -Product php prints it. Wildcards are allowed, but the pattern must match exactly one archive, because every match is installed one after another.
• In the archive name, nts means non-thread-safe (thread-safe builds have no nts part), x64 or x86 is the architecture, and vs16, vc15 or VC11 is the compiler.
• PHP is extracted to the install folder, in a subfolder named after the archive. The default install folder is C:\Program Files. If that subfolder already exists, the install fails with exit code 5.
• Without -NoPath, the new folder is added to the machine Path and every other Path entry containing php is removed. With -NoPath, the Path isn't touched on install or uninstall.
• -Modules lists the extensions to enable in the generated php.ini. All others stay listed but disabled. If you leave -Modules out, every extension is disabled.
• For repeat runs, leave out -LicenseKey and the saved token is used. Passing -LicenseKey on a server that's already registered fails with exit code 2. Installing an archive that's already installed prints "already installed" and exits with 0.
• Exit codes: 0 success, 2 already registered, 3 registration failed or no token, 4 nothing matched, 5 install failed, 14 not elevated.

TuxCare.Installer.exe is a WiX Burn bundle and takes the standard Burn switches: /install, /uninstall, /repair, /layout, /quiet, /passive, /norestart, /forcerestart and /log. Run it elevated for a quiet install:

TuxCare.Installer.exe /install /quiet /norestart /log C:\Temp\tuxcare-install.log

TuxCare.Installer.exe /uninstall /quiet /norestart uninstalls and keeps the installed PHP. Adding UninstallProducts=1 also uninstalls PHP and releases the server registration.

The TuxCare build number isn't shown by php -i. It appears only in the zip file name, which follows the pattern php-<version>-tuxcare-els<N>-nts-Win32-vs16-x64-signed.zip. The PowerShell script extracts PHP into a folder named after the archive, without the .zip extension. Each zip contains news.txt, and its "Security (TuxCare ELS backports)" section lists the CVEs backported in that build.

Updates are manual. For a PHP installation without a control panel, replace all files in the PHP folder except the .ini files, which works in most cases.

There is no TuxCare extension for Plesk on Windows. The ELS builds can replace the contents of the matching Plesk PHP folders, keeping the third-party extensions already in those folders. The build's architecture has to match the Plesk PHP folder being replaced, and the Visual C++ runtime has to match the build's compiler, listed in the architectures question above.

A fixed build keeps its PHP version and changes only its release number, as the fix-status question above explains. TuxCare publishes this security data for ELS for PHP:

• Errata advisories, covering security and selected bug-fix errata: https://security.tuxcare.com/errata/els_alt_php/<os>/
• OVAL patch definitions for OpenSCAP and similar tools: https://security.tuxcare.com/oval/els_alt_php/<os>/oval.xml
• CSAF advisories with VEX data, which shows which known CVEs affect specific package versions: https://security.tuxcare.com/csaf/v2/els_alt_php/<os>/
• An RSS release feed for tracking updates: https://tuxcare.com/cve-tracker/api/cves/export/rss?product=PHP (opens in new tab)

<os> is the OS path segment, such as el8, ubuntu22.04 or debian12. Errata and CSAF cover EL 6 to 10, Ubuntu 16.04 to 24.04, Debian 10 to 13 and Alpine 3.23 to 3.24. OVAL covers the same systems except Alpine. Ubuntu 26.04 has the RSS feed only. Packages and their metadata are signed and distributed from a registry TuxCare manages. SBOMs in SPDX or CycloneDX format are available for some packages, and availability varies by package, so contact TuxCare about a specific one. Details: machine-readable security data (opens in new tab).

TuxCare supports CakePHP (opens in new tab) under ELS for Language Ecosystems, with patched versions 2.10.24, 4.4.18 and 5.0.11 delivered from a Composer repository on TuxCare's Nexus. Other CakePHP versions are available on request. Access requires Nexus credentials, which you get from TuxCare. TuxCare also adds other PHP Composer packages on request.

Update to a fixed build. Upstream PHP states that this is the only complete fix. Until then, do these steps:

• Restrict access to the site. Use an AWS security-group allowlist or a VPN.
• Set session.upload_progress.enabled = 0. This closes one known attack path for CVE-2026-109619 only. Set it in php.ini, in a PHP-FPM pool, or in server configuration that applies before request parsing, then restart every worker. Don't rely on ini_set() or a PHP-FPM .user.ini file for this.
• Block multipart (form or upload) requests if the site does not need them. Crafted multipart requests trigger CVE-2026-109618.

Imunify360 with the WAF enabled receives rulesets 8.83 to 8.88 automatically. Ruleset 8.83 blocks the publicly circulating exploit request. The rulesets are a virtual patch: they stop known request patterns at the server edge while the vulnerable PHP code stays as it is. As of October 23, 2026, no rule blocks the out-of-memory path of CVE-2026-109618. Rule coverage is different on LiteSpeed, and the CloudLinux status post (opens in new tab) has the details. Imunify360 with the WAF disabled, ImunifyAV and ImunifyAV+ get no coverage from these rulesets. Only the PHP update closes the flaws.

On some servers, yes. PHP committed fixes for 7.4, 8.0 and 8.1 to its source tree without tagging releases, and community scripts now rebuild source-compiled PHP with them. That route fixes one bug, only on PHP you compiled yourself, and only on the platforms the scripts automate. Distro packages, mod_php and LiteSpeed's lsphp are out of scope, and the rebuilt binaries never get another update, so the next PHP CVE starts the whole build again. ELS for PHP delivers fixed builds through yum, dnf or apt, keeps patching your branch after php2shell, and publishes OVAL data your scanner can read.