PHP2Shell: How to Check Whether Your PHP Is Patched (Debian, Ubuntu, Alpine, RHEL, Docker)

Distributions such as Debian, Ubuntu and RHEL usually backport security fixes into the PHP version they already ship. The upstream part of the version stays the same and only the package revision changes, so php -v can show an "old" version on a fully patched server.

Some hosting panels rebuilt end-of-life branches (PHP 7.4, 8.0, 8.1) under the same version numbers, so the fix is only visible in the package build or build date. The reverse also happens: a version string that looks current can come from an image that was built before the fix and never pulled again.

Run php -v in every environment that serves requests, including containers and workers. Builds from php.net or the official Docker image are fixed from 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Docker tags such as php:8.3-fpm move: pull the tag again, rebuild every image that uses it as a base, redeploy, and confirm with docker run --rm your-image php -v. An image built yesterday from the same tag still contains the vulnerable version.

List installed packages with dpkg -l 'php*' | grep ^ii, or apt-cache policy php8.2-cli for a single package. Compare the package version (for example 8.2.x-1~deb12uN) with the fixed version in your release's security advisory, not with php.net.

If you use the deb.sury.org (Ondřej Surý) repository, its 8.2–8.5 packages follow the fixed upstream releases, while its end-of-life builds (such as 8.1 and 7.4) carry a backport under the old version number; compare with the fixed builds on the tracker.

On Alpine, apk info -v | grep ^php shows packages such as php83-8.3.x-rN; compare them with the fixed version in the Alpine security database for your branch.

On RPM-based systems, rpm -qa 'php*' shows version and release (for example php-cli-8.2.x-1.el9_N). Compare the full version-release with your vendor's errata; Remi's repository ships the fixed upstream releases for 8.2–8.5 and backports for 7.4–8.1.

Package upgrades do not replace code already loaded into long-running PHP-FPM pools, Apache mod_php or queue workers. Restart PHP-FPM, Apache and workers, then check again with php -v or the package query.

If you cannot update today, apply the PHP team's interim mitigations and treat them as temporary: they reduce exposure but are not a substitute for the patched build.