MediaWiki and PHP2Shell

PHP2Shell is two serious flaws in PHP, the language MediaWiki runs on. A MediaWiki update leaves PHP as it is, so it does not fix them. Update PHP on the server, then restart PHP.

Last reviewed 22 October 2026. Rules of 22 October 2026.

What to do

Find the PHP version that serves your site (see below).
Update PHP to a fixed release that your MediaWiki version supports: 8.3.36, 8.4.27 or 8.5.12 for MediaWiki 1.46; 8.2.35 or 8.3.36 for 1.45 and 1.43. Later releases in the same branch also work.
Restart PHP-FPM or your web server.
If your host runs PHP for you, ask them to do this and to confirm the version.

What the checker can see

The checker reads one ordinary page of your wiki. For MediaWiki it looks for:

A generator meta tag that names MediaWiki. If the tag has a version number, the checker shows it next to the name.
MediaWiki assets in the page, such as load.php links or the api.php?action=rsd link.
The PHP version in the X-Powered-By header, if your server sends it. PHP sends X-Powered-By unless expose_php is turned off, and it is on by default.

The MediaWiki version does not change the result. Only the PHP version does.

Where to see the PHP version

Open the page Special:Version on your wiki. The Installed software table has a row for PHP. It shows the PHP version and, in brackets, how PHP runs, for example fpm-fcgi.

That is the PHP that serves your wiki pages, and the one that matters. If the row shows only the branch (for example 8.3) and not the full version, check the version on the server or ask your host.

On the command line: php -v prints the version of the command-line PHP. The PHP behind your wiki pages can be a different version or build, so check that one too.
In your hosting panel: it may show a PHP version for each site. If you are not sure which one serves the wiki, ask your host.
From outside: run curl -sI https://example.com/ to see the response headers, and look for X-Powered-By. A missing header tells you nothing either way.

Supported PHP versions

MediaWiki data from the mediawiki.org version lifecycle and PHP compatibility pages. Fixed releases from php.net.
MediaWiki	Status	PHP range	Support ends	Fixed PHP releases in range
1.46	Current stable	8.3 – 8.5	July 2027	8.3.36, 8.4.27, 8.5.12
1.45	Legacy stable	8.2 – 8.3	December 2026	8.2.35, 8.3.36
1.43	Long-term support	8.1 – 8.3	December 2027	8.2.35, 8.3.36

MediaWiki 1.43 allows PHP 8.1, but PHP 8.1 gets no new release from the PHP project. Move to 8.2.35 or 8.3.36, or use a vendor build of 8.1 that has the fix.
MediaWiki 1.44 and 1.42 are obsolete and get no security fixes. The next long-term support release, 1.47, is planned for November 2026.

How to update PHP

Managed hosting: pick a fixed PHP version in the hosting panel, or have your host install one.
Your own server: update the PHP packages through your package manager. Some Linux distributions keep the old version number on a fixed build, so check the package, not only the number. See Fixed versions.
Containers: our advice is to rebuild the image on a fixed PHP base image, then replace the running containers.
Restart: the PHP2Shell researchers say to restart Apache, PHP-FPM and every long-running PHP worker after the update. Until a process restarts, it keeps the old PHP in memory.
Job runner: if a service or cron job runs runJobs.php for a long time (for example with --wait), restart it too, so it loads the new PHP (our advice). Jobs that run during web requests use the web server's PHP.
Run the checker again, and confirm the version with your host.

Notes

The flaws are in PHP, so updating MediaWiki or its packages does not fix them. php.net says every PHP install that serves web requests is at risk.
No configuration setting is a complete workaround; updating PHP is the fix. If you must wait, see the interim measures on Mitigations.
PHP 8.2 gets security fixes only until 31 December 2026. Plan the move to 8.3 or later now.
The PHP project ships no new release for PHP 8.1 and older. Some vendors ship fixed builds of them, but not all.
php2shell.com says the flaws can leak server memory, which can hold passwords, tokens and keys. If your wiki server ran an affected PHP while it was reachable from the internet, our advice is to rotate those secrets after the update.

Sources

Check your site

The checker reads one ordinary page of your wiki and shows the public PHP signals it found. It sends no attack traffic.

Check my site