Sources checked as of October 22, 2026.
Incident and impact
PHP2Shell concerns out-of-memory handling and stale state across requests in the PHP engine. Inventory PHP runtimes that handle Web requests: application login checks, framework upgrades, and Composer dependency updates cannot replace fixes to the underlying engine.
Priority actions
- Upgrade to a fixed release in the relevant branch. For distribution packages, check the vendor advisory and full package version to confirm coverage of both vulnerabilities.
- Restart services or roll over containers, and confirm that every old worker and replica has exited.
- Verify the SAPI, version, and configuration through the actual Web entry point. Run regression checks for login, sessions, uploads, and error handling.
Running php -v alone does not prove that the live Web instance is fixed. If an immediate upgrade is impossible, prioritize controls on untrusted traffic before PHP. Configuration mitigations and WAF rules have limited coverage and are not complete fixes. Once the patch is active, review temporary settings and restore appropriate resource budgets.
Read the full causes and remediation guide for branch-specific versions, configuration templates, patch analysis, and official sources.