Is my phpMyAdmin exposed to PHP2Shell?
Your phpMyAdmin is exposed if the PHP that serves it is below the fixed release for its branch, or is PHP 8.1 or older without a vendor patch. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of flaws in PHP itself, so the phpMyAdmin version doesn’t change whether you are in scope.
phpMyAdmin deserves extra attention for two reasons. It is often left reachable on a public URL, and it sits next to your database. A takeover of the PHP process that serves phpMyAdmin can expose the database credentials and data it can reach.
Does upgrading phpMyAdmin fix PHP2Shell?
No. A new phpMyAdmin release changes phpMyAdmin code, not PHP. Keep phpMyAdmin current, but the PHP2Shell fix comes only from updating PHP to a fixed release or your vendor’s patched package.
We found no phpMyAdmin statement about PHP2Shell as of 22 Oct 2026. The phpMyAdmin news page still shows 5.2.3 (8 October 2025) as the latest post, and the security page lists nothing newer than its 2025 advisories. PHP2Shell is not a phpMyAdmin bug, so no phpMyAdmin advisory is expected.
How do I find the PHP version phpMyAdmin runs on?
Open phpMyAdmin’s home page. The Web server panel lists the PHP version that serves phpMyAdmin, unless your administrator has hidden server information.
This matters because phpMyAdmin doesn’t always share your website’s PHP. A distribution package uses the system PHP, a control panel may serve phpMyAdmin itself, and the Docker image brings its own PHP. Check phpMyAdmin directly, then enter the version in the PHP2Shell checker. More methods: check PHP version.
Which PHP version should phpMyAdmin move to?
Any fixed release from PHP 8.2 up meets the current phpMyAdmin’s requirement. phpMyAdmin’s download page lists:
| phpMyAdmin | Status | PHP requirement | Fixed releases to choose from |
|---|---|---|---|
| 5.2 (5.2.3) | Stable, fully supported | PHP 7.2 or newer | 8.2.35 to 8.5.12 |
| 4.9 | Security support only | PHP 5.5 or newer | Move to 5.2 on a fixed PHP |
| 6.0 | In development | PHP 8.2 or newer | Not for production |
| Branch | First fixed release |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
| 8.1 and older | No new release; official source patches for 7.4, 8.0 and 8.1 |
The 5.2.3 release notes mention fixes for PHP 8.4 and PHP 8.5 deprecations, so the newer branches are covered. If phpMyAdmin runs on PHP 7.4, 8.0 or 8.1, there is no new PHP release for those branches; see PHP end of life.
Who updates PHP for phpMyAdmin?
| How phpMyAdmin is installed | Who updates PHP | Guide |
|---|---|---|
| Hosting control panel (cPanel, Plesk) | Your host | PHP2Shell patch: ask your host |
| Distribution package on your server | You, with the system PHP | Update PHP on Ubuntu |
Official phpmyadmin Docker image | You pull the new image | Docker PHP image |
| XAMPP or a similar local bundle | You, when the bundle updates | Keep it local-only |
Docker image: the official phpmyadmin image is built on Docker’s PHP 8.3 image, which received the fixed releases. Docker Hub shows the phpmyadmin tags re-pushed on 21 October 2026, but we haven’t verified the PHP inside them. Pull with docker compose pull, recreate the container and check the PHP version on the home page.
How do I tell if phpMyAdmin or the database was already compromised?
Updating PHP stops new attacks but says nothing about the past. Check:
- Database accounts: users you don’t recognise in the User accounts tab, or new privileges.
- Database contents: unexpected tables, triggers, events or admin users inside your apps’ tables.
- phpMyAdmin folder: changed
config.inc.php, or.phpfiles in itstmp, upload or save directories. - Other sites on the server: phpMyAdmin usually shares a server with them; check those too.
If you find something, follow the compromise checklist, then change the database passwords phpMyAdmin can reach.
Does a WAF or access restriction protect phpMyAdmin until I patch?
They reduce exposure but are not a fix. Allow phpMyAdmin only from your IP address, behind a VPN, or behind web server authentication that runs before PHP. Cloudflare says its WAF blocks known patterns, but saw attackers altering requests to get past it. PHP’s official stopgaps block specific paths only; see the CVE-2026-109618 workaround. Then follow the PHP2Shell patch guide.
phpMyAdmin is behind a login. Doesn't that protect it?
No. PHP2Shell is in PHP, and PHP has confirmed at least one attack path that runs before any application code, including phpMyAdmin's login. Restricting access at the web server or network level reduces exposure; updating PHP fixes it.
I only use phpMyAdmin on my own computer through XAMPP or a similar bundle. Is that a risk?
The risk is much lower if it is reachable only from your own machine. Update the bundle's PHP when a fixed version is available, and make sure it doesn't listen on your network or the internet.
Check your PHP for PHP2Shell
Enter the version your website reports. We compare it with the first fixed release for its branch and tell you what to do next.
PHP2Shell checker →Sources
The core facts on this page (fixed versions, CVE details, vendor packages and agency warnings) come from official sources. Research, news and community posts are labelled as such.
- Security advisory: Critical remote code execution vulnerabilities, update nowOfficial The PHP Group
- RCE via OOM corruptionOfficial The PHP Group
- RCE via stale global stateOfficial The PHP Group
- [security] Update to 8.5.12, 8.4.27, 8.3.36, 8.2.35Vendor Docker Official Images maintainers
- docker compose pullOfficial Docker
- Cloudflare deploys protections against php2shell vulnerabilityCDN vendor Cloudflare
- Official phpMyAdmin project
- Downloads (version support table)Official phpMyAdmin project
- phpMyAdmin 5.2.3 is releasedOfficial phpMyAdmin project
- phpMyAdmin security announcementsVendor phpMyAdmin