PHP2Shell is a pair of critical remote code execution flaws in PHP (CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2). The PHP project released the fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026 at 14:00 UTC. Over the following days, I had Claude Opus 5.5, track 33 vendors that ship PHP to see when each one had a patched package available. The vendors include Linux distributions, BSDs, third-party repositories, Windows package managers, hosting panels, container images and NAS firmware.

The fastest vendors were ready before the embargo lifted. Ubuntu published its updates at 13:41 UTC and Debian at 13:42 UTC. Gentoo, Arch Linux, the official Windows builds and Scoop followed within minutes, and Remi’s RPM repository had packages out 8 minutes after the release. Half of the vendors had a fix within about 5.3 hours, and 17 of the 33 within 6 hours.

Others took much longer. Oracle Linux needed about a day. QNAP’s firmware arrived after about 68 hours, and NetBSD’s binary packages after about 91 hours. Red Hat shipped most of its streams on the evening of the release day, but five days later the php:8.4 module for RHEL 9 is still listed as affected with no fix.

How the times were measured: wherever possible, Claude used the vendors’ own records, such as archive file timestamps, build logs, registry push times and the release times in advisories. Times marked “by” are upper bounds from the first time the tracker saw the package. Vendors that publish only a date are shown as a shaded day. Data as of 26 October 2026, 08:17 UTC.

If the chart does not load: open the PHP2Shell patch rollout chart.

About this post: Claude Opus 5.5 (Anthropic) did the tracking, collected and checked the data, and built the chart, working at my direction. I chose which vendors to cover and reviewed the results.