{"id":383,"date":"2026-10-26T09:36:46","date_gmt":"2026-10-26T08:36:46","guid":{"rendered":"https:\/\/blog.forestraven.net\/?p=383"},"modified":"2026-10-26T10:00:56","modified_gmt":"2026-10-26T09:00:56","slug":"how-fast-did-vendors-ship-the-php2shell-fix","status":"publish","type":"post","link":"https:\/\/blog.forestraven.net\/index.php\/how-fast-did-vendors-ship-the-php2shell-fix\/","title":{"rendered":"How fast did vendors ship the PHP2Shell fix?"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">PHP2Shell is a pair of critical remote code execution flaws in PHP (CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2). The PHP project released the fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026 at 14:00 UTC. Over the following days, I had Claude Opus 5.5, track 33 vendors that ship PHP to see when each one had a patched package available. The vendors include Linux distributions, BSDs, third-party repositories, Windows package managers, hosting panels, container images and NAS firmware.<\/p>\n\n\n\n<!--more-->\n\n\n\n<p class=\"wp-block-paragraph\">The fastest vendors were ready before the embargo lifted. Ubuntu published its updates at 13:41 UTC and Debian at 13:42 UTC. Gentoo, Arch Linux, the official Windows builds and Scoop followed within minutes, and Remi&#8217;s RPM repository had packages out 8 minutes after the release. Half of the vendors had a fix within about 5.3 hours, and 17 of the 33 within 6 hours.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Others took much longer. Oracle Linux needed about a day. QNAP&#8217;s firmware arrived after about 68 hours, and NetBSD&#8217;s binary packages after about 91 hours. Red Hat shipped most of its streams on the evening of the release day, but five days later the php:8.4 module for RHEL 9 is still listed as affected with no fix.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>How the times were measured:<\/strong> wherever possible, Claude used the vendors&#8217; own records, such as archive file timestamps, build logs, registry push times and the release times in advisories. Times marked &#8220;by&#8221; are upper bounds from the first time the tracker saw the package. Vendors that publish only a date are shown as a shaded day. Data as of 26 October 2026, 08:17 UTC.<\/p>\n\n\n\n<iframe id=\"php2shell-chart\" src=\"https:\/\/blog.forestraven.net\/wp-content\/uploads\/php2shell-rollout.html\" title=\"PHP2Shell patch rollout: how fast vendors shipped the fix\"\n        style=\"display:block;box-sizing:border-box;width:100%;max-width:none;height:1800px;border:0\" loading=\"lazy\"><\/iframe>\n<script>\n(function () {\n  var f = document.getElementById('php2shell-chart');\n  if (!f) return;\n  \/\/ Widens the frame past the text column, up to 1400px, without covering the theme's sidebar or leaving the screen.\n  function place() {\n    var vw = document.documentElement.clientWidth;\n    var box = (f.closest('#content') || document.body).getBoundingClientRect();\n    var left = Math.max(box.left, 0) + 16, right = Math.min(box.right, vw) - 16;\n    var w = Math.min(1400, right - left);\n    f.style.width = w + 'px';\n    f.style.marginLeft = '0';\n    f.style.marginLeft = (left + (right - left - w) \/ 2 - f.getBoundingClientRect().left) + 'px';\n  }\n  \/\/ Sets the frame to the chart's content height (measured directly when the chart is on the same site).\n  function measure() { try { return Math.ceil(f.contentDocument.body.getBoundingClientRect().height); } catch (e) { return 0; } }\n  function fit(h) { if (h > 100 && Math.abs(h - f.offsetHeight) > 1) f.style.height = h + 'px'; }\n  window.addEventListener('message', function (e) {\n    if (e.source === f.contentWindow && e.data && e.data.php2shellHeight) fit(measure() || e.data.php2shellHeight);\n  });\n  f.addEventListener('load', function () { fit(measure()); });\n  window.addEventListener('resize', place);\n  place();\n})();\n<\/script>\n<p style=\"font-size:13px\">If the chart does not load: <a href=\"https:\/\/blog.forestraven.net\/wp-content\/uploads\/php2shell-rollout.html\">open the PHP2Shell patch rollout chart<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>About this post: Claude Opus 5.5 (Anthropic) did the tracking, collected and checked the data, and built the chart, working at my direction. I chose which vendors to cover and reviewed the results.<\/em><\/p>\n\n","protected":false},"excerpt":{"rendered":"<p>PHP2Shell is a pair of critical remote code execution flaws in PHP (CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2). The PHP project released the fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026 at 14:00 UTC. Over the following days, I had Claude Opus 5.5, track 33 vendors that ship PHP to see &hellip; <a href=\"https:\/\/blog.forestraven.net\/index.php\/how-fast-did-vendors-ship-the-php2shell-fix\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">How fast did vendors ship the PHP2Shell fix?<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[39],"tags":[],"class_list":["post-383","post","type-post","status-publish","format-standard","hentry","category-it-hacking"],"_links":{"self":[{"href":"https:\/\/blog.forestraven.net\/index.php\/wp-json\/wp\/v2\/posts\/383","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.forestraven.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.forestraven.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.forestraven.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.forestraven.net\/index.php\/wp-json\/wp\/v2\/comments?post=383"}],"version-history":[{"count":5,"href":"https:\/\/blog.forestraven.net\/index.php\/wp-json\/wp\/v2\/posts\/383\/revisions"}],"predecessor-version":[{"id":390,"href":"https:\/\/blog.forestraven.net\/index.php\/wp-json\/wp\/v2\/posts\/383\/revisions\/390"}],"wp:attachment":[{"href":"https:\/\/blog.forestraven.net\/index.php\/wp-json\/wp\/v2\/media?parent=383"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.forestraven.net\/index.php\/wp-json\/wp\/v2\/categories?post=383"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.forestraven.net\/index.php\/wp-json\/wp\/v2\/tags?post=383"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}