PHP2Shell and Drupal: is your Drupal site affected?

Is my Drupal site affected by PHP2Shell?

Your Drupal site is affected if the PHP it runs on is below the fixed release for its branch, or is PHP 8.1 or older without a vendor patch. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of flaws in PHP itself, so every Drupal site on an unpatched PHP is in scope, whatever its core version or modules.

Drupal has been tested specifically. Wiz reports that it demonstrated unauthenticated remote code execution on Drupal deployments, as well as on WordPress and Joomla.

Does updating Drupal core fix PHP2Shell?

No. Core and module updates don’t change the PHP your server runs. The Drupal Security Team said so directly in PSA-2026-10-20, published ahead of the PHP release: “Updating to a PHP release containing the patch to these vulnerabilities is the only complete mitigation.” The PSA tells you to apply the update yourself if you manage PHP, and to follow your host’s instructions if they manage it.

Don’t confuse this with the Drupal core release of 14 October 2026 (announced in PSA-2026-10-12). That fixed a separate Drupal bug. Install it too, but it does nothing for PHP2Shell.

How do I find the PHP version Drupal runs on?

You can check without server access:

1. Sign in as an administrator.
2. Open Reports → Status report (/admin/reports/status).
3. Note the PHP version shown there. This is the PHP serving your website.

With Drush, drush status shows the PHP version too, but it reports the command-line PHP, which can differ from the PHP-FPM or Apache module that serves pages. Trust the Status report for the website.

Enter the version in the PHP2Shell checker to see whether it is fixed. More methods: check PHP version.

Which PHP version should my Drupal site move to?

Move to the fixed release on a PHP branch your Drupal version supports. Drupal’s PHP requirements page lists:

Drupal 10 still supports PHP 8.1, but PHP 8.1 gets no new release from PHP. Use a vendor-patched package (for example, Ubuntu shipped a fixed php8.1 for 22.04) or move to 8.2 or newer. Drupal 7 is end of life; if it runs on old PHP, see PHP end of life. The quickest safe move is usually the fixed release on the branch you already use, such as 8.3.x to 8.3.36.

Who updates PHP for my Drupal site?

It depends on how the site is hosted.

After the update, restart PHP-FPM or Apache, clear Drupal’s cache and reload the Status report to confirm the new version.

How do I tell if my Drupal site was already compromised?

Updating PHP stops new attacks but says nothing about the past. In Drupal, check:

• Users: accounts with the Administrator role you don’t recognise (People → filter by role).
• Files directory: .php files in sites/default/files, which should hold only uploads.
• Modules: anything under Extend or modules/custom you didn’t install.
• Settings: unexpected changes to settings.php or .htaccess.

If you find something, follow the full compromise checklist before cleaning up, then change passwords and the hash_salt in settings.php.

Does a WAF or a PHP setting protect Drupal until I patch?

Neither is a fix. Cloudflare says its WAF blocks known attack patterns, and it also saw attackers altering their requests to slip past. Drupal modules run on top of PHP and can’t patch it, and PHP has confirmed at least one attack path that runs before any application code. PHP’s official stopgaps only block specific paths; see the CVE-2026-109618 workaround for their limits. Use the PHP2Shell patch guide to get PHP updated.