Type the upstream version from php -v. Checks CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) and the branch's support status as of October 21, 2026.
Distribution packages (Ubuntu, Debian, RHEL) often keep an old upstream number and backport the fix, so 8.3.6 on Ubuntu 24.04 can be patched. For those, compare the package version from dpkg -l or rpm -q with your vendor's advisory instead.