Paste any one of: php -v · dpkg -l | grep php · rpm -qa | grep php · docker tag (php:8.3-fpm). PHPANIC parses it, cross-references the upstream fix table AND vendor backports (Ubuntu / Debian / RHEL), and tells you in one shot: patched, naked, or likely-exposed — plus the one command that fixes it. Nothing is sent anywhere.
8.3.35 upstream
Ubuntu 24.04 before fix
Ubuntu 24.04 after fix
Docker tags
RHEL 10 after fix
end-of-life
CVE-2026-109618 (RCE via OOM corruption) · CVE-2026-109619 (RCE via stale global state). CVSS 4.0 base 9.2. Unauthenticated remote code execution as the web-server account, triggered before application code runs. Fixed upstream on 2026-10-21.
Branches 8.1, 8.0, 7.4 and older get NO upstream release — only a source-only backport branch. Distribution vendors backport the fix to older branches too (Ubuntu, Debian, RHEL, Alpine), so a package version string alone can lie. PHPANIC checks both.
| BRANCH | FIXED IN | STATUS |
|---|