Affected PHP versions & patch evidence

How to read the upstream release table

The first fixed releases in our reviewed advisory snapshot are shown below. Use them as branch-specific minimums for these two CVEs, then check current releases for subsequent security fixes. They are not a permanent recommendation to remain on those exact builds.

A supported distribution may fix both issues without adopting that upstream version string. A third-party repository or vendor build needs its own evidence. Never compare only the leading numeric part of a vendor package.

Confirmed backports are legitimate

Ubuntu USN-8948-1 lists fixes including PHP 8.1.2-1ubuntu2.28 for Ubuntu 22.04 and PHP 8.3.6-0ubuntu0.24.04.13 for Ubuntu 24.04. Those package revisions illustrate why a simplistic version checker can be wrong. Check the notice for your exact release and repository.

Debian’s notices list PHP 8.2.35-1~deb12u1 for Debian 12 and PHP 8.4.27-1~deb13u1 for Debian 13. Package availability and support conditions can change; consult the linked vendor notice.

Identify what is actually running

Record the PHP handler, FPM pool or container that your web server uses. Check every pool, node, image and scheduled job. Use authenticated server administration or your host’s support channel; do not publish a phpinfo() page.

command -v php
php -v
php --ini

Unsupported upstream branches

An end-of-life upstream branch requires migration to a supported release or explicit evidence of a maintained vendor security fix. Vendor support and upstream support are separate facts. Do not assume a legacy service is fixed because it still runs successfully.