PHP2Shell Patch Checklist: Is Your PHP or Laravel App Safe?

Two critical PHP flaws are being exploited, and a separate Laravel auth bug affects older 12.x and 13.x apps. Here is how to check your servers and fix them in about an hour.

Category: Engineering

If your website, web app or API runs on PHP, check your PHP version today. Emergency security fixes came out less than two weeks ago, and attackers are already using the flaws they patch.

This post covers the PHP fixes and a separate critical Laravel bug. Each step is something you can do or hand to your developer.

What happened

On 21 October 2026 the PHP team released fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They address two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution. In plain terms, an attacker can run their own code on your server without logging in.

The timeline was rough. Details of the flaws leaked online on October 20, before the coordinated disclosure and before patches were out. The scope is wide. According to PHP, every installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

This is not only a theoretical risk:

• watchTowr reports exploitation in the wild.
• CISA added CVE-2026-109618 to its Known Exploited Vulnerabilities catalog on October 26.
• The release notes say there are no complete mitigations and that updating is the only safe choice.

So do not wait for a maintenance window next month.

Step 1: List every place PHP runs

Most teams patch the main server and forget the rest. Write down everything that serves PHP over HTTP:

• Production and staging servers
• Docker images and anything built from them
• Shared or managed hosting accounts, including client sites you look after
• Old projects on a forgotten VPS
• Internal tools and admin panels

A small business site on shared hosting counts. So does a WordPress install, since WordPress runs on PHP.

Inventory: one table for every app

Turn the list from Step 1 into a single table, so nothing is missed when you patch. For every PHP and Laravel app, record:

• App: the name and URL.
• PHP and Laravel version: the version the web server runs, not just the command-line one, plus the Laravel version if it applies.
• Owner: the developer who is responsible for it.
• Hosting: where it runs, such as a VPS, shared hosting, a container platform or a client's server.

Here is an example of how it can look:

Caption: One table, one row per app. Every row needs a version, an owner and a host.

A row with an empty owner or hosting cell is the first thing to fix. Those are the apps that get forgotten. Keep the table in a shared document and update it each time you patch.

Step 2: Check your PHP version

On a server you control, run:

php -v

That shows the command-line version. Your web server can run a different one, so also check the PHP-FPM or Apache version, or look at the PHP version shown in your hosting control panel.

Compare what you find with the fixed releases:

PHP 8.4 and 8.5 are in active support, while 8.2 and 8.3 receive only security fixes.

What if you run PHP 8.1 or older?

That is the bad case. Only the four supported branches, 8.2 through 8.5, can receive the fix. If you are on anything older, upgrading is the only way to close this hole. Treat it as urgent and move to 8.4 or 8.5.

Even on 8.2, plan ahead. PHP 8.2 reaches end of life on 31 December 2026 and gets no security fixes after that.

Step 3: Update and restart

How you update depends on your setup:

• Your own server: update PHP through your package manager, then restart PHP-FPM or Apache. A patched package does nothing while old worker processes are still running.
• Docker: pull a patched base image, rebuild, and redeploy. Updating the host does not change what is inside your containers.
• Shared or managed hosting: open your control panel or ask your host which PHP build they run. Do not assume it is patched. Ask for the exact version number.
• Platforms with bundled PHP: check the vendor's security notices and apply their update.

After the restart, check the version again. Run php -v, or put a temporary page behind a password that prints PHP_VERSION, then delete it.

Test the update on staging first if you can. Patch releases within a PHP branch are meant to be drop-in. For a flaw this serious, the risk of waiting is bigger than the risk of the update.

Step 4: Check Laravel too

This is a separate issue, but it landed in the same month. A critical auth bypass in Laravel's token API guard let attackers log in as other users on MySQL and MariaDB. The fix is in Laravel 12.68.0 and 13.29.0.

Not every Laravel app is affected. You are exposed only if all of these are true:

1. laravel/framework is older than the fixed version.
2. A guard in config/auth.php uses the plain token driver.
3. Routes use that guard, often written as auth:api.
4. Your users are stored in MySQL or MariaDB.

Sanctum and Passport guards are unaffected. Only the plain token driver is. If you are unsure what a token guard protects, our plain-English explanation of APIs covers the basics.

To check and fix:

composer show laravel/framework
composer update laravel/framework
composer show laravel/framework

The first command shows your current version. After the update, run the third to confirm you are on 12.68.0, 13.29.0 or later. Then run your tests and deploy.

Older Laravel versions

One write-up notes there is no fixed release for Laravel 11 or anything older. If you are on those, the real fix is upgrading to Laravel 12 or 13. If that takes time, consider switching the affected routes to Sanctum.

Step 5: Assume you may already have been probed

Patching closes the door. It does not remove someone who is already inside. Exploitation began the day the fixes came out, so look back at the period since October 20.

Check these:

• New or changed PHP files in folders the web server can write to, such as uploads, cache and storage directories
• Unknown admin users or recent password resets you did not trigger
• Unfamiliar scheduled jobs (cron) or background processes
• Odd outbound connections from the server
• Web server logs with strange requests from October 20 onward

If anything looks wrong, rotate your secrets: database passwords, API keys, and everything in your .env file. Restore from a clean backup if you can. Our website security checklist covers the wider basics, including backups and access control.

Workflow: check, patch, test, confirm

Run every app in your inventory through the same four steps, in this order:

1. Check. Read the PHP and Laravel versions from the inventory table and compare them with the fixed releases. Mark each app as patched or not patched.
2. Patch. Update PHP and, where it applies, laravel/framework. Restart PHP-FPM or Apache, or rebuild and redeploy your containers.
3. Test. Run your automated tests and click through the key pages: login, checkout, forms and API calls. Do this on staging first when you have one.
4. Confirm. Check the live version again with php -v or your control panel. Then update the table with the new version and the date.

Do not mark an app as done until step 4 is finished. A patch that was installed but never restarted still leaves you exposed.

Caption: The same four steps for every app, in the same order.

A related PHP issue and a mobile note

A third PHP flaw was disclosed on October 23. It affects only web applications configured in an unusual way, PHP considers it unlikely, and there is no out-of-band release for it. Organisations are advised to apply the mitigation instead. Read the official advisory and see whether your setup matches.

If you ship mobile apps built with NativePHP, its team published seven security advisories and rebuilt PHP binaries, and advises updating to 4.6.1 or 3.3.11 and rebuilding.

Make this routine

This week showed how fast a PHP flaw can go from leak to attack. A few habits make the next one easier:

• Keep a living inventory of servers, PHP versions and framework versions.
• Run composer audit in CI so known-vulnerable packages fail the build.
• Subscribe to the security announcement lists for PHP and for your framework.
• Keep staging close to production so patches can be tested in minutes.
• Move off end-of-life PHP and framework versions before the deadline, not after.

Need a second pair of eyes?

If you have several PHP apps and no clear picture of what runs where, a short audit pays for itself. Aneta Prime's Software Systems & APIs team can review your servers, frameworks and API authentication, then patch and upgrade what needs it.

Tags: php, laravel, security, php2shell, patching, web development, vulnerability