PHP2Shell patch rollout

—

Data as of 26 Oct 2026, 08:17 UTC. Covers the PHP2Shell security release (CVE-2026-109618, CVE-2026-109619) only; regular PHP releases that follow are not tracked. All times UTC.

Vendors with a patched package
—
at least one tracked product shipped
Fastest vendor
—
—
Median vendor, first package
—
after the 14:00 UTC upstream release
Vendors still missing a package
—
—

How fast each vendor had the patch available, by family

Time from the upstream release (Oct 21, 14:00 UTC) to the vendor's packages, grouped by family and fastest first within each group. The dot is the first patched package; the line runs on until every tracked product of that vendor had one. Negative times mean packages were out before the embargo lifted. A dashed red line is still missing for some products and runs open-ended to the right edge, which is the last package shipped by any vendor. Log scale spreads out the first hours; it is a symmetric log of hours from the release, so times before the release still show.

Branch
Scale

Where PHP runs: share of public web servers by operating system

From W3Techs' survey of the top 10 million websites, which detects the server OS from HTTP headers. It can name the OS family for most PHP sites but the Linux distribution for only about a quarter of Linux sites, and its distribution figures cover all Linux websites, not PHP sites alone. BSD and the other Unix systems together are about 0.1%.

Timeline: fix in source and package per product

Hollow diamond: the fix appears in the vendor's source (packaging git, changelog, QA). Filled dot: the package is in the vendor's repository or registry. A dashed line with an arrow runs to the right edge while the package is still missing; the axis ends at the last package shipped by any vendor. Hover a lane for times and sources.

Branch
Range
Scale
Fix in vendor source Package available Still waiting Package seen by then (upper bound) Date known, time not (shaded day, circle at its end, UTC)

Every tracked build

Times in UTC. "vs release" is the package time minus the public release (Oct 21, 14:00 UTC); negative means the vendor shipped before the embargo lifted.

VendorProductBranchVersion Fix in sourcePackage outvs releaseStatusNotes and sources

PHP versions: last vulnerable and first patched

CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state), both CVSS v4.0 9.2. Fix commits landed on the release branches on Oct 18; tags were cut Oct 19; public release Oct 21, 14:00 UTC.

BranchLast vulnerableFirst patched Fix committedTaggedReleasedNotes

Sources for every time are linked in the table above (vendor advisories, archive file times, build records). Times marked "by" are upper bounds; "date only" means the vendor published no time. Data collected, checked and charted by Claude Opus 5.5 (Anthropic) at the author's direction.