Upstream PHP Release — Glossary

The longer version

The PHP project publishes stable versions on supported release branches and issues point releases for bug or security corrections. Its release announcements and changelogs describe the upstream code and give a clear reference for projects building or downloading PHP directly.

Operating-system distributions can rebuild that source with their own patches, dependencies and package revisions. Therefore the upstream version is not always the final word on a distribution package's security state. Conversely, an unsupported upstream branch is not made safe by its age or familiarity.

Containers and static applications may be built from official upstream source, distributor packages or vendor-specific forks. The correct patch method depends on that provenance and on whether the PHP process loads any separately maintained libraries or extensions.

Use the official PHP release notes for upstream builds, distribution advisories for packaged builds, and supplier documentation for embedded products.

Where we use “Upstream PHP Release”

CybersecurityHow to Verify Your PHP2Shell Patch Beyond php -v
The PHP in your terminal may not be the PHP serving your site, and a patched build can keep an old version number. Here is how to verify the build that actually runs.
Nov 6, 2026
CybersecurityDoes a WordPress Update Fix PHP2Shell? No
PHP2Shell sits in PHP, not WordPress, so only a patched PHP runtime fixes it. Here is how to check your build and what WordPress itself still needs.
Nov 5, 2026

The longer version

Where we use “Upstream PHP Release”

Get the Core in your inbox.