You read the PHP2Shell advisory. The fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. You log in to your Ubuntu 24.04 server, run php -v , and it says PHP 8.3.6 . That is thirty patch releases below 8.3.36.

Is the server exposed? Maybe not. This article shows how to get a real answer in about five minutes.

Why the number can lie

PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) is a pair of flaws in PHP itself, not in WordPress, Laravel or any other app. The PHP project published the fixes on 21 October 2026 ( GHSA-w8hw-w9fx-j79w , GHSA-6wmf-4rv5-p3rp ). The research is on php2shell.com .

Linux distributions do not jump to a new upstream release in a stable branch. They take the fix, apply it to the version they already ship, and add a build number to the package version.…