After the PHP2Shell release (CVE-2026-109618 and CVE-2026-109619, php.net advisory of 21 October 2026 ), many people ran a scanner or asked an AI agent whether their servers are fixed. On some systems, the answer comes back wrong in both directions.

Disclosure: we run php2shell.fyi , a passive checker for PHP2Shell.

Wrong answer 1: a fixed server shows as vulnerable

The PHP project fixed the flaws in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Some distributions put the fix into the version they already ship and keep the old upstream number:

System Fixed build php -v shows

Ubuntu 24.04 php8.3 8.3.6-0ubuntu0.24.04.13 ( USN-8948-1 ) 8.3.6

Ubuntu 22.04 php8.1 8.1.2-1ubuntu2.28 (USN-8948-1) 8.1.2

RHEL 9 php-8.0.30-8.el9_8.1 ( RHSA-2026:87151 ) 8.0.30

Chainguard php-8.4 8.4.26-r4 8.4.26

A tool that reads only 8.3.6 and compares it with 8.3.36 says "vulnerable".…