PHP2Shell on your platform
Every product on this page runs on PHP, and PHP2Shell is a flaw in PHP itself, not in one app. If the PHP under your site is not fixed, the site is exposed, whatever product version you run. Updating the product does not update PHP.
Last reviewed . Rules of .
What fixes it
Install PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or a build from your Linux vendor or host that contains the patch. Your product needs no update for this, only a fixed PHP under it.
The researchers showed attacks without a login on WordPress, Drupal and Joomla. They also showed a memory disclosure that does not depend on which app you run.
Pick your product
CMS and shops
- WordPress and WooCommerce: the PHP version is under Tools › Site Health › Info. A green Site Health result checks the PHP branch, not the fix, so do not trust it.
- Drupal: the PHP version is in the Status report. Drupal 11 needs PHP 8.3 or newer, so install 8.3.36 or 8.4.27, or 8.5.12 from Drupal 11.3.
- Joomla: System Information shows the PHP version and how the web server runs PHP. Joomla 6 needs PHP 8.3 or newer.
- Magento Open Source and Adobe Commerce: you check PHP on the command line. Magento 2.4.4 and 2.4.5 support only PHP 8.1, which has no fixed release.
Frameworks
- Laravel: the PHP versions Laravel 12 and 13 support, and how to update.
- Symfony: PHP versions for Symfony 8.1, 7.4 and 6.4, and why an exposed profiler is a separate risk.
Web apps
- MediaWiki: the PHP version on Special:Version, and the PHP ranges for MediaWiki 1.43 to 1.46.
- Moodle: where Moodle shows its PHP version, and the fixed PHP release for each Moodle version.
- Nextcloud: where to see the PHP version, which fixed PHP to install, and AIO and Docker notes.
- phpMyAdmin: which PHP to install, and why the panel should not be public.
- WHMCS: PHP ranges for WHMCS 9.1, 9.0 and 8.13, and the ionCube Loader you need.
Hosting panels
- cPanel, Plesk and shared hosting: where to see the PHP version, which EasyApache 4 build has the fix, and a message to send your host.
- Plesk: the PHP version and handler of each site, Plesk PHP builds next to the OS PHP, updates and restarts.
- DirectAdmin: the PHP version of each domain, CustomBuild updates for every installed PHP version, and PHP-FPM restarts.
- aaPanel: the PHP column in the site list, App Store updates, and why Linux updates do not touch aaPanel's PHP.
Why a product update is not enough
The flaw is in the PHP program that runs your site. On some setups it can be reached while PHP reads a request, before your app code runs. A WordPress, Drupal, Joomla or Magento update changes the app files. It does not change the PHP program, and no plugin or extension can patch it.
The researchers say even a plain “Hello World” page on an affected PHP can be exposed.
Some product versions run only on old PHP branches. PHP 8.1 and older get no new PHP releases (see PHP 7.4, 8.0 and 8.1). The PHP security team published source patches for 7.4, 8.0 and 8.1 only, and nothing for 7.3 or older. If your product is stuck on such a branch, you need a patched build from your vendor or host, or a product upgrade that allows a newer PHP.
How to update PHP where you host
- Shared or managed hosting: your host runs PHP. Use the PHP menu in your hosting panel if it has one, and ask your host to confirm the fix. See cPanel, Plesk and shared hosting.
- Your own server: install the PHP updates from your Linux vendor and restart PHP. See Ubuntu, Debian, RHEL, AlmaLinux and Rocky Linux and Alpine.
- Containers: pull or build an image with a fixed PHP and recreate the container.
On shared or managed hosting, ask your host this:
Which PHP build serves my site, and does it include the fixes
for CVE-2026-109618 and CVE-2026-109619?An old version number does not always mean PHP is unfixed: Linux vendors and hosts often patch an old version and keep its number. See Fixed versions for the full list.
After the update, restart PHP-FPM, Apache and any long-running PHP workers. Until they restart, they keep running the old PHP. For containers, our advice is to rebuild the image and recreate the container, because a restart alone does not change the PHP inside it.
What the checker looks at
Product signs, such as a generator tag, tell the checker only that PHP is probably in use. The verdict depends on the PHP version the server reports. See how the checker works.
Other PHP apps
Other shop systems, other CMS and custom PHP code are in the same position. Check the PHP that your web server uses, not the app version. Some apps support only older PHP branches, so read the app’s PHP requirements before you pick a fixed release.
Check your site
Run the php2shell.fyi checker on your site. It makes at most three ordinary GET requests and shows every PHP signal it saw. It cannot see inside your server, so confirm the result with your host.