The patching challenges
The PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 as the official fixed versions, but relying on version numbers alone is not enough due to the way PHP is distributed. Most servers run Linux distributions that deliver application updates through their own package managers, including long-term support (LTS) distributions that bundle older PHP versions. In many cases, patches will have to be manually backported by package maintainers for those specific distros.
For example, PHP 7.4, 8.0, and 8.1 are officially end-of-life, even though they’re still widely used. The PHP developers published minimal source backports for those versions to help package maintainers, but PHP 7.3 and older were not covered at all. Vulnerability intelligence firm VulnCheck found that 42% of the 2.6 million internet-facing PHP hosts it scanned were running end-of-life branches, including 27% on PHP 3.x through 7.3 and 15% on 7.4, 8.0, or 8.1.
Obtaining the fix on LTS distributions requires different approaches depending on the bundled PHP version. On Ubuntu 22.04 it arrives as a free PHP 8.1 update; on Ubuntu 20.04 the PHP 7.4 fix requires a Pro subscription; on Debian 11 the fix for the bundled PHP 7.4 sits behind a Freexian extended-support contract; and on AlmaLinux 8 it arrives as a backport for the retired PHP 7.2, 7.3, and 8.0. Red Hat Enterprise Linux, SUSE, Alpine, and Amazon Linux each draw their own support boundaries and those determine whether a fix exists at all for different distro versions.
