PHP2Shell patch-availability census 2026 — dataset
Servnet Research (https://www.servnetuk.com/research/php2shell-2026)

WHAT THIS IS
One row per PHP install channel and release line we could trace to a primary source, recording
when (and whether) a fix for the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619
became available on that channel. Reference point: the upstream PHP release on 21 October 2026,
14:00 UTC (8.2.35 / 8.3.36 / 8.4.27 / 8.5.12). Compiled 27 October 2026 from vendor security
trackers, advisories, package indexes and git commits; every row carries its source URL and an
exact quote.

ROWS: 92 across 35 channel families.
CLASSIFICATION counts: fixed=75, not-applicable=2, note=1, pending=4, statement=3, wont-fix=7

COLUMNS
  platform            the install channel (distro, image, repo, panel or cloud platform)
  release_stream      the release / module stream within that channel
  fixed_version       the fixed package or build version (or the status where none)
  date_published_utc  the time the source shows, converted to UTC (see date_basis)
  date_basis          what that time actually is: advisory date, mail Date header, CSAF
                      initial_release_date, a package build time, a git merge, or a file
                      Last-Modified. Where the source gives no timezone, the basis says so.
  days_after_21oct    calendar days after 21 Oct 2026 (negative/0 = on or before release day)
  hours_after_1400utc hours relative to the 14:00 UTC coordinated release, where a time exists
  status              the vendor's own wording, or a direct reading of the vendor's data
  classification      fixed | pending | wont-fix | not-applicable | statement | note (derived)
  eol_branches_fixed  whether that channel shipped a fix for EOL branches (7.4 / 8.0 / 8.1)
  source_url          the primary source
  quote               a short exact quote from that source

IMPORTANT CAVEATS
  1. Several timestamps are FILE or BUILD times, not publication times (noted per row in
     date_basis). A file existing is not the same as users being able to install it.
  2. Some sources give no timezone; those are read as UTC and the basis says so.
  3. The Windows "-1" rebuilds (26 Oct) are classified 'note': they fix a separate Brotli bug
     (CVE-2026-111497), not PHP2Shell; the PHP runtime version is unchanged.
  4. Every "fixed" version is still subject to CVE-2026-115560 (session upload progress), for
     which php.net advises session.upload_progress.enabled=0 until the next regular release.
  5. "fixed" for EOL branches often means a vendor backport or paid extended-support channel,
     not an upstream release. php.net itself ships only source backports for 7.4 / 8.0 / 8.1.

LICENCE
  Servnet's derived dataset and compilation: Creative Commons Attribution 4.0 (CC BY 4.0).
  Attribute "Servnet Research — PHP2Shell patch-availability census 2026" with a link to the
  study page. The underlying vendor advisories and package data remain their publishers' own;
  this dataset records and links them, it does not relicense them.

CORRECTIONS
  webmaster@servnetuk.com — see https://www.servnetuk.com/research/corrections