PHP2Shell.fyi Check a site

PHP2Shell on Drupal

PHP2Shell is a flaw in PHP, so a Drupal site is exposed when the PHP under it is not fixed. Drupal core and module updates do not change PHP. You or your host have to update PHP itself.

Last reviewed . Rules of .

What to do

  1. Find the PHP version your site runs (see below).
  2. Pick a fixed PHP release that your Drupal version supports.
  3. Update PHP, or ask your host to do it, and make sure PHP restarts.
  4. Open the Status report again and check the new version.

The researchers showed attacks without a login on Drupal with both flaws, on the latest Drupal container image at the time.

Find your PHP version

Go to Reports › Status report (/admin/reports/status) and find the PHP section. Its "more information" link opens the full phpinfo() page.

On the server, php -v shows the command-line PHP, which can differ from the PHP your web server runs. For the website, trust the Status report.

Which PHP your Drupal version supports

PHP support from drupal.org; fixed releases from php.net.
DrupalPHP branchesFixed releases to use
10.4 to 10.68.1 to 8.48.2.35, 8.3.36, 8.4.27
11.1 and 11.28.3 and 8.48.3.36, 8.4.27
11.3 and 11.48.3 to 8.58.3.36, 8.4.27, 8.5.12
12.08.58.5.12

Drupal 10 allows PHP 8.1, but PHP 8.1 has no fixed release. On Drupal 10, move to PHP 8.3.36 or 8.4.27. Drupal 10 reaches end of life in December 2026, and Drupal 11 runs on these branches too, so the same move prepares your Drupal 11 upgrade.

PHP 8.2 security support ends on 2026-12-31.

How to update PHP

On shared or managed hosting, ask your host this:

Which PHP build serves my site, and does it include the fixes
for CVE-2026-109618 and CVE-2026-109619?

Restart every PHP process afterwards, and rebuild any containers (see after you update).

Then open the Status report again. If it still shows the old version, the web server still runs the old PHP.

What the checker can see

For Drupal, the checker looks for:

These signs point to Drupal, so PHP is probably in use. The verdict itself depends on the PHP version the server reports. See how the checker works.

Check your site

Run the php2shell.fyi checker on your Drupal site. It sends at most three ordinary GET requests and lists every PHP signal it saw. It cannot see inside your server, so confirm the result with your host.

Sources