Moodle and PHP2Shell

Moodle runs on PHP, and PHP2Shell is two flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619), so a Moodle update does not fix it. Install a fixed PHP release that your Moodle version supports.

Last reviewed 22 October 2026. Rules of 22 October 2026.

What fixes it

• A PHP update. Updating Moodle or its plugins does not update PHP.
• The fixed PHP releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
• Each Moodle version supports only some PHP branches. The table below shows which.
• Because the flaw is in PHP, it does not depend on the app. The researchers say even a plain “Hello World” page on an affected PHP is exposed.

See your PHP version in Moodle

1. Log in to Moodle as an administrator.
2. Go to Site administration › Server › PHP info.
3. The page shows the PHP version and settings that your Moodle website uses.

The command line on the server can use a different PHP or a different php.ini. If Moodle tasks run from the command line, update that PHP too.

Before you change PHP, open Site administration › Server › Environment. It checks your site against the system requirements of the current and future Moodle versions.

Which PHP release to install

Moodle 5.0 gets no more fixes from Moodle. Update PHP first, and plan the Moodle upgrade as a separate task. Moodle 4.5 (LTS) gets security fixes until 4 October 2027, and 5.3 (LTS) until 1 October 2029 (moodledev.io).

PHP 8.2 gets security fixes only until 31 December 2026. If your Moodle version supports 8.3 or 8.4, prefer one of those.

Still on PHP 8.1?

Moodle 4.5 also runs on PHP 8.1, but the PHP project has no 8.1 release with the fix. The PHP security team published source backports for 7.4, 8.0 and 8.1 only. Some Linux distributions and hosts ship 8.1 builds that include the fix and keep the old version number. Ask your OS vendor or host, or move Moodle 4.5 to PHP 8.3.36 or 8.2.35. See Fixed versions.

How to update PHP

• On shared hosting or cPanel, your host updates PHP. See cPanel, Plesk and shared hosting for what to ask.
• On your own server, install the PHP update from your OS vendor or PHP package source.
• Our advice for Docker: pull the updated image and recreate the container. A restart alone keeps the old image and the old PHP.

After the update

• Restart PHP-FPM, Apache and every other PHP process. Old processes keep running the old PHP.
• Open Site administration › Server › PHP info again and confirm the new version.
• If you set memory_limit = -1 as a stopgap, set a finite limit again.
• php2shell.com says memory disclosure can expose passwords, API keys and other secrets, even without code execution. If your site ran an affected PHP, change the passwords and keys stored on the server.

Technical notes

• php.net says every PHP install that serves web requests is at risk. It names PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates mod_php as the highest risk, because a shown exploit runs before any application code.
• For CVE-2026-109619, remote code execution through PHP-FPM was confirmed; it needs a suitable application operation. Moving from mod_php to PHP-FPM is not a fix.
• The researchers showed attacks on WordPress, Drupal and Joomla and published none for Moodle. That does not lower the risk, because the flaw is in PHP.
• No configuration setting fully replaces the update. Mitigations lists interim steps.

Sources

• php.net security advisory, 21 October 2026
• GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
• php.net: Supported versions
• GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
• php2shell.com research
• Moodle developer docs: PHP policy
• Moodle developer docs: releases and support dates
• Moodle docs: PHP
• Moodle docs: Environment

Check your site

Our checker reads the public response of your Moodle site and reports any PHP version it can see. Check my site.