phpMyAdmin and PHP2Shell

phpMyAdmin runs on PHP, and PHP2Shell is two serious flaws in PHP itself. Updating phpMyAdmin does not fix them. Update PHP on the server, then restart PHP.

Last reviewed 22 October 2026. Rules of 22 October 2026.

What to do

Find the PHP version that serves your site (see below).
Update PHP to a fixed release in your current branch: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Later releases in the same branch also work.
Restart PHP-FPM or your web server.
If your host runs PHP for you, ask them to do this and to confirm the version.

Fix this too: a database admin panel open to the internet. Anyone who reaches phpMyAdmin can try to log in to your database. This is a separate problem from PHP2Shell.

Our advice: allow access only from known IP addresses or through a VPN, whatever your PHP version. See Restrict access.

What the checker can see

The checker reads only the URL you submit, plus redirects on the same site. For phpMyAdmin it looks for:

A phpMyAdmin cookie (named phpMyAdmin or phpMyAdmin_https), or a page title that names phpMyAdmin. If it finds one, it shows a "phpMyAdmin exposed" warning.
The PHP version in the X-Powered-By header, if your server sends it. PHP sends X-Powered-By unless expose_php is turned off, and it is on by default.
A PHPSESSID cookie, or links and forms that point to .php pages.

The checker reads cookie names, never their values. It does not look for phpMyAdmin at other paths on your server, so submit the phpMyAdmin URL itself to check it. The PHP2Shell result depends on the PHP version alone.

Where to see the PHP version

After you log in, the phpMyAdmin main page shows detailed server information. The setting for this is $cfg['ShowServerInfo'], and it is on by default. If the page does not show the PHP version, check on the server or ask your host.

On the command line: php -v shows the command-line PHP. The PHP that serves phpMyAdmin can be a different version or build, so check that one too.
In your hosting panel: it may list the PHP version per site. If you are not sure which one serves phpMyAdmin, ask your host.
From outside: curl -sI https://example.com/ shows the response headers; look for X-Powered-By. A missing header tells you nothing either way.

Supported PHP versions

phpMyAdmin data from phpmyadmin.net/downloads and the phpMyAdmin 5.2.3 composer.json. Fixed releases from php.net.
phpMyAdmin	Status	PHP range	Fixed PHP releases in range
5.2	Stable (latest 5.2.3, 8 October 2025)	7.2 or later	8.2.35, 8.3.36, 8.4.27, 8.5.12
4.9	Long-term support, security fixes only	5.5 or later, below 8.0	None from the PHP project

The phpMyAdmin download page says 5.2.3 is “compatible with PHP 7.2 and newer”, and its composer.json allows any PHP 8 release. If you already run PHP 8.4 or 8.5, stay on that branch: 8.4.27 and 8.5.12 have the fix, so do not move down to an older one. If you do change branch, our advice is to test phpMyAdmin on the new PHP first. PHP 8.2.35 also has the fix, but PHP 8.2 support ends on 31 December 2026.
phpMyAdmin 4.9 needs PHP below 8.0. The PHP project has no fixed release in that range, only source patches for 7.4, and some vendors ship fixed builds. Our advice is to move to phpMyAdmin 5.2.

How to update PHP

Managed hosting: pick a fixed PHP version in the hosting panel, or ask your host to install it.
Your own server: update the PHP packages with your package manager. Some Linux distributions ship fixed builds that keep the old version number, so check the package and not only the number. See Fixed versions.
Containers: rebuild the image on a fixed PHP base image and replace the running containers. That is our advice.
Restart: the PHP2Shell researchers say to restart Apache, PHP-FPM and every long-running PHP worker after the update. Old processes hold the old PHP in memory until then.
Run the checker again, and confirm the version with your host.

Restrict access

Our advice is to keep phpMyAdmin off the open internet. Allow only known IP addresses, or put it behind a VPN. In nginx, for example:

location ^~ /phpmyadmin/ {
    allow 203.0.113.10;
    deny all;
    # Put the PHP handler inside this block. With ^~, nginx does not use
    # the site-wide "location ~ \.php$" block, which would skip allow/deny.
    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_pass unix:/run/php/php-fpm.sock;
    }
}

Then test it. From an address that is not on the list, request /phpmyadmin/index.php. The answer must be 403 Forbidden.

In Apache:

<Location "/phpmyadmin">
    Require ip 203.0.113.10
</Location>

Use your own path and addresses. Among other steps, the phpMyAdmin documentation also recommends these:

Serve phpMyAdmin over HTTPS only.
Put an extra login in front of it, for example HTTP authentication in the web server.
Turn on two-factor authentication for your account.
Limit which database users can log in, with $cfg['Servers'][$i]['AllowDeny']['rules'], or block root with AllowRoot.
Remove the setup directory after the first setup.

Notes

The flaws are in PHP, not in phpMyAdmin. Updating phpMyAdmin or its packages does not fix them. php.net says every PHP install that serves web requests is at risk.
No configuration change fully works around the flaws, so update PHP. If you must wait, see the interim measures on Mitigations.
PHP 8.2 security fixes stop on 31 December 2026. Plan a move to 8.3 or later.
PHP 8.1 and older get no new release from the PHP project. Fixed builds for them come only from some vendors.
php2shell.com says the flaws can leak server memory, which can hold passwords, tokens and keys. If the server ran an affected PHP while it was reachable from the internet, our advice is to rotate those secrets after the update, database passwords included.

Sources

Check your site

The checker reads one ordinary page at the URL you submit and shows the public PHP signals it found. It sends no attack traffic.

Check my site