Vulnerabilities in end-of-life PHP versions
The PHP versions that old Linux distributions still run, with every vulnerability the US National Vulnerability Database lists for them. Open a version to see its full list.
Request a server assessmentPHP versions past end of life
| PHP | Ships with | End of life | Known CVEs | Critical | PHP2Shell | Forkward |
|---|---|---|---|---|---|---|
| 5.3.3 | CentOS 6, RHEL 6 | 14 August 2014 | 266 | 61 | Not affected | Fork on demand, 48 h |
| 5.4.16 | CentOS 7, RHEL 7 | 3 September 2015 | 224 | 60 | Affected | Fork on demand, 48 h |
| 5.5.9 | Ubuntu 14.04 | 21 July 2016 | 231 | 72 | Affected | Fork on demand, 48 h |
| 5.6.40 | Last 5.6 release | 31 December 2018 | 18 | 4 | Affected | Fork on demand, 48 h |
| 7.0.33 | Ubuntu 16.04, Debian 9 | 10 January 2019 | 26 | 8 | Affected | Fork on demand, 48 h |
| 7.1.33 | Last 7.1 release | 1 December 2019 | 7 | 2 | Affected | Fork on demand, 48 h |
| 7.2.34 | Last 7.2 release | 30 November 2020 | 8 | 3 | Affected | Fork on demand, 48 h |
| 7.3.33 | Last 7.3 release | 6 December 2021 | 10 | 4 | Affected, both flaws | Fork on demand, 48 h |
| 7.4.33 | Debian 11 | 28 November 2022 | 6 | 2 | Affected, both flaws | Fork on demand, 48 h |
| 8.0.30 | Last 8.0 release | 26 November 2023 | 5 | 2 | Affected, both flaws | Fork on demand, 48 h |
End-of-life dates from php.net. Vulnerabilities from the US National Vulnerability Database, 28 October 2026, counting only entries where PHP itself is the vulnerable product. Distribution builds include some vendor fixes; your assessment shows which risks are real.
PHP2Shell
CVE-2026-109618 and CVE-2026-109619 are exploited in the wild and have no official fix below PHP 8.2.35. Which versions are affected
Fork on demand, 48 h
We backport the fix to the version you run within 48 hours of your order, or within 24 hours with priority delivery. See the plans