Drupal · PHP2Shell

Is my Drupal site affected by PHP2Shell?

Probably, unless your PHP is already patched. Drupal was the first application researchers took over with PHP2Shell, but the bug sits in PHP, so your Drupal version and modules do not change the answer.

Last reviewed 2026-10-22

Updating Drupal does not fix this

PHP2Shell is in PHP itself, below Drupal. Researchers demonstrated unauthenticated remote code execution against the official drupal:latest image — Drupal was the first confirmed target, on 20 August 2026. What matters is the PHP version your server runs, and only whoever manages the server can update it.

1. Find your PHP version in Drupal

This shows the PHP that actually serves your site, which is the one that matters.

  1. Log in as an administrator and go to Reports → Status report (/admin/reports/status).
  2. Find the PHP row — it shows the version the web server runs.
  3. Sites on Drupal 7 show it in the same place.
command line (shows the CLI PHP — may differ from the web server)
drush status --field=php-version     # Drush (CLI PHP)
drush php:eval 'echo PHP_VERSION, PHP_EOL;'

2. Compare it

Paste a version, the output of php -v, or one version per line for a whole fleet. Runs entirely in your browser.

Try:

The CLI and the web server can run different PHP builds. Check the version your web server actually uses: php-fpm -v (or php-fpm8.3 -v), or phpinfo() served by that site.

BranchVulnerableFixed in
8.5< 8.5.128.5.12
8.4< 8.4.278.4.27
8.3< 8.3.368.3.36
8.2< 8.2.358.2.35
8.1 · 8.0 · 7.4allSource backport only
5.4 – 7.3allNo fix

3. Get it patched

Shared or managed hosting

Your host patches PHP. Choose the newest PHP version in your hosting panel, then ask them to confirm the patch and the restart. Hosting guide →

Your own server, VPS or container

You (or your developer) patch PHP and restart PHP-FPM / Apache. Patch guide →

email to your host
Subject: PHP2Shell (CVE-2026-109618 / CVE-2026-109619) — patch status

Hi,

Please confirm that the PHP runtime serving my site(s) <domain> has been
updated to a release that fixes CVE-2026-109618 and CVE-2026-109619
(PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or a vendor build with the backport),
and that PHP-FPM / LSAPI workers were restarted afterwards.

If my account is on PHP 8.1 or older, please tell me which patched version
I can move to.

Thanks

Managed Drupal hosting

Drupal platforms such as Acquia and Pantheon manage PHP for you. We have not verified their patch status — check their status pages or support, or send the message above.

Self-hosted with Docker? Rebuild on a fixed php base image or pull the rebuilt drupal image and confirm the PHP version inside the container before deploying.

4. After patching

  • Check the PHP version in Drupal again — it should show a fixed release (or ask your host to confirm a backported build).
  • If the site was exposed for a while, change admin passwords and API keys stored in the site configuration, and look for unknown admin users or new PHP files. Detection guide →

Questions

Is my Drupal site affected by PHP2Shell?+

If it runs on PHP older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (and the host has not installed a patched package), yes. The Drupal version, theme and extensions do not matter — the bug is in PHP.

Will updating Drupal fix PHP2Shell?+

No. Drupal updates change the application, not the PHP runtime underneath. Keep Drupal updated anyway, but the fix is a PHP update by whoever runs your server.

Does an attacker need an admin account?+

No. The demonstrated attacks are pre-authentication: no login, no special plugin or module, just HTTP requests to the site.

Is there a Drupal security advisory for PHP2Shell?+

PHP2Shell is not a Drupal vulnerability, so a Drupal core release does not fix it. Follow the PHP advisories and your hosting or OS vendor for the runtime update.

Does Drupal 7 make a difference?+

Not for this bug, but Drupal 7 sites often run on old PHP (7.4 or earlier), which gets no new PHP release. Those sites need a PHP migration — and therefore usually a Drupal upgrade too.

Related