PHP2Shell and Laravel: is your Laravel app affected?

Is my Laravel app affected by PHP2Shell?

Your Laravel app is affected if the PHP it runs on is below the fixed release for its branch, or is PHP 8.1 or older without a vendor patch. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of flaws in PHP itself. Laravel’s own response post calls them “extremely serious vulnerabilities affecting every PHP application on the web”.

Does updating Laravel or running composer update fix PHP2Shell?

No. Laravel, its packages and your vendor folder are PHP code; they don’t change the PHP binary your server runs. The fix is a PHP update. Laravel published platform-specific steps on 21 October 2026 (last updated 23:26 UTC that day):

• Laravel Cloud: Laravel says it patched every running application in place, with no redeploy needed. Apps now run 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and new deployments use updated base images.
• Forge: on PHP 8.2 to 8.5, open each server and click Update PHP; if that fails, update over SSH. Servers on Ubuntu 20.04 or older can’t get the update: Laravel advises moving sites to a new server and powering the old one down meanwhile.
• Vapor: patched runtimes are live. Native runtimes on PHP 8.2 or later need a redeploy; custom or Docker image runtimes need a new deployment.
• PHP 8.0 or 8.1 on Forge or Vapor: no patch is available. Upgrade to PHP 8.2 or later.

Laravel’s Forge advisory adds that Forge’s automatic security updates don’t patch PHP, and that you should update every installed PHP version, including ones no site uses.

How do I find the PHP version my Laravel app runs on?

Check the PHP that serves requests, not only your terminal:

• Command line: php artisan about lists the PHP version under Environment. This is the command-line PHP.
• Web (PHP-FPM): on Forge, the PHP tab lists installed versions; over SSH, the Forge advisory checks both php8.4 -v and php-fpm8.4 -v (swap in your branch).
• Vapor: the runtime in vapor.yml sets the branch; the patch level comes from your latest deployment.

Enter the version in the PHP2Shell checker. More methods: check PHP version.

Which PHP version should my Laravel app move to?

Move to the fixed release on a branch your Laravel version supports. Laravel’s support policy lists:

Staying on your current branch (for example 8.3.x to 8.3.36) is the quickest move. Laravel 10 apps on PHP 8.1 have no new PHP release to install; move to 8.2 or 8.3, and plan a Laravel upgrade. See PHP end of life.

Who updates PHP for my Laravel app?

Restart long-running processes. Updating packages restarts PHP-FPM, but queue workers, Horizon, Octane and Reverb keep running the old PHP until restarted (queue:restart, horizon:terminate, octane:reload). This step is easy to miss.

How do I tell if my Laravel app was already compromised?

Updating PHP stops new attacks but says nothing about the past. Check:

• public: .php files other than index.php.
• storage: PHP files that your app didn’t write.
• Scheduler and cron: tasks you didn’t add, and changes to .env.
• Your app’s users: new admin accounts or role changes.

If you find something, follow the compromise checklist, then rotate the secrets in .env. Rotating APP_KEY logs users out and breaks data encrypted with the old key unless you list it in APP_PREVIOUS_KEYS.

Does a WAF or a PHP setting protect Laravel until I patch?

Neither is a fix. Cloudflare says its WAF blocks known patterns, but it saw attackers altering requests to get past it. Laravel middleware runs after PHP has parsed the request, and PHP has confirmed at least one attack path that runs before any application code. PHP’s stopgaps only block specific paths; see the CVE-2026-109618 workaround. Get PHP updated with the PHP2Shell patch guide.