What the check does
The checker compares the patch number in a PHP 8.2–8.5 version with the first upstream release that contains both PHP2Shell fixes. It is a version comparison, not a vulnerability scan: it does not contact your server and cannot tell whether a host was exploited.
| Branch | Affected releases | First fixed release |
|---|---|---|
| PHP 8.5 | < 8.5.12 | 8.5.12 |
| PHP 8.4 | < 8.4.27 | 8.4.27 |
| PHP 8.3 | < 8.3.36 | 8.3.36 |
| PHP 8.2 | < 8.2.35 | 8.2.35 |
| PHP 8.1 and older | No upstream fix | Vendor backport or upgrade |
Version strings can mislead
A distribution backport may keep an older visible version while containing the fix. A CLI binary may differ from the FPM or Apache module serving the site. Use the verification guide before treating a host as fixed.
If the checker says you are affected
- Update to the first fixed release for the branch, or a vendor package confirmed to contain both fixes.
- Restart PHP-FPM, Apache with mod_php or the container. A package update alone can leave old workers serving requests.
- Verify the process, package or image that actually serves HTTP.
- If the host was exposed while unpatched, preserve evidence and rotate secrets before rebuilding.
The patch tracker has the branch table and restart sequence. The dossier keeps the CVE scope, exploitation status and evidence boundaries in one place.