Laravel and PHP2Shell

PHP2Shell is two serious flaws in PHP itself, the language Laravel runs on. A Laravel update does not fix them. Update PHP on the server, then restart PHP.

Last reviewed 22 October 2026. Rules of 22 October 2026.

What to do

Find the PHP version that serves your site (see below).
Update PHP to a fixed release that your Laravel version supports: 8.3.36, 8.4.27 or 8.5.12 (Laravel 12 also allows 8.2.35). Later releases in the same branch also work.
Restart PHP-FPM or your web server, Octane and your queue workers.
If your host runs PHP for you, ask them to do this and to confirm the version.

What the checker can see

The checker reads one ordinary page of your site. For a Laravel site it looks for:

A cookie named laravel_session, which suggests the site runs Laravel. If your app uses another cookie name, the checker misses this signal. An XSRF-TOKEN cookie alone does not count.
The PHP version in the X-Powered-By header, if your server sends it. PHP sends X-Powered-By unless expose_php is turned off, and it is on by default.

The checker reads cookie names, never their values, and it cannot see your Laravel version. A Laravel signal only shows that the site runs PHP. The result depends on the PHP version alone.

Where to see the PHP version

On the command line: php -v shows the command-line PHP. The PHP that serves your web pages can be a different version or build, so check that one too.
In your hosting panel: the panel may list the PHP version for each site. If you cannot tell which one serves the site, ask your host.
From outside: curl -sI https://example.com/ prints the response headers. Look for X-Powered-By. If the header is missing, that tells you nothing either way.

If you serve the app with Laravel Octane on FrankenPHP, Octane downloads its own FrankenPHP binary, or you run a FrankenPHP Docker image. Our advice is to check the PHP version of that binary or image as well as the system PHP.

Supported PHP versions

Laravel ranges from the Laravel support policy. Fixed releases from php.net; later releases in each branch also have the fix.
Laravel	PHP range	Security fixes until	Fixed PHP releases in range
13	8.3 – 8.5	17 March 2028	8.3.36, 8.4.27, 8.5.12
12	8.2 – 8.5	24 February 2027	8.2.35, 8.3.36, 8.4.27, 8.5.12
11	8.2 – 8.4	Ended 12 March 2026	8.2.35, 8.3.36, 8.4.27

Laravel 11 and older get no more security fixes from Laravel. Update PHP first, then plan the Laravel upgrade as a separate task.

How to update PHP

Managed hosting: choose a fixed PHP version in the hosting panel, or ask your host to install one.
Your own server: update the PHP packages with your package manager. Linux distributions often ship fixed builds under the old version number, so check the package, not only the number. See Fixed versions.
Containers: our advice is to rebuild the image on a fixed PHP base image and replace the running containers.
Restart: the PHP2Shell researchers say to restart Apache, PHP-FPM and every long-running PHP worker after the update. Old processes keep the old PHP in memory until they restart.
Queue workers: Laravel queue workers are long-lived processes. Restart them with php artisan queue:restart. Each worker exits after its current job, and a process manager such as Supervisor has to start it again.
Octane: php artisan octane:reload reloads the application workers. After a PHP update, our advice is to restart the whole Octane server through your process manager, so it loads the new PHP.
Run the checker again, and confirm the version with your host.

Notes

Updating Laravel or its packages does not fix PHP2Shell, because the flaws are in PHP. php.net says every PHP install that serves web requests is at risk.
No configuration change fully works around the flaws. Updating PHP is the fix. If you have to wait, see the interim measures on Mitigations.
PHP 8.2 gets security fixes only until 31 December 2026, so plan a move to 8.3 or later.
The PHP project ships no new release for PHP 8.1 and older. Only some vendors ship fixed builds of those branches.
php2shell.com says the flaws can leak server memory, which can hold passwords, tokens and keys. If the server ran an affected PHP while it was reachable from the internet, our advice is to rotate those secrets after the update.

Sources

Check your site

The checker loads one ordinary page of your site, with no attack traffic, and shows the public PHP signals it found.

Check my site