If you maintain a Laravel application on a VPS or dedicated server, PHP2Shell is a security issue you should investigate immediately.

The vulnerabilities CVE-2026-109618 and CVE-2026-109619 affect PHP's internal request handling and can potentially allow remote code execution without authentication.

The PHP project released fixed versions on October 21, 2026. The affected PHP runtime can be used by Laravel, WordPress, Drupal, Joomla, and other PHP applications.

From a developer's point of view, there is one important thing to understand before making any changes.

Updating Laravel is not the same as updating PHP.

A secure Laravel application still depends on the PHP runtime and operating-system packages underneath it. Let's look at how to check and protect a typical production server.

Step 1: Identify the PHP versions installed on the server

Start by checking the command-line PHP version:

php -v

Then inspect the loaded PHP configuration:

php --ini

On a Linux server using PHP-FPM, inspect the available services:

systemctl list-units --type=service --all | grep -E 'php.*fpm|apache2'

These commands help identify the environment without changing anything.

Do not assume that the command-line version is necessarily the version serving every website.

For example, your server may contain:

PHP 8.2-FPM for one website.

PHP 8.1-FPM for another website.

A command-line PHP installation using a different version.

Each web-facing runtime must be checked.

For servers running multiple projects, make a list of the websites and the PHP versions assigned to them. This reduces the chance of patching one installation while leaving another exposed.

Step 2: Determine whether your installed package contains the security fix

For upstream PHP installations, the October 21 security announcement lists these fixed releases:

The exact package version you need depends on how PHP was installed. Operating-system vendors may backport fixes into their own packages instead of using the exact upstream release number.

On a Debian- or Ubuntu-based server, inspect the installed PHP packages:

dpkg-query -W 'php*' 2>/dev/null

To examine package candidates and available updates, use the relevant package names. For example, on a server with PHP 8.2:

apt-cache policy php8.2-cli php8.2-common php8.2-fpm

Adjust the package names to match your installed PHP version.

Check the security status of the package with the operating-system vendor's advisory. Do not compare only the visible upstream PHP version number when a distribution-managed package may contain a backported fix.

Step 3: Update PHP using the appropriate package manager

For a Debian- or Ubuntu-based server, start by refreshing the package information:

sudo apt update

Review the available security updates and the packages associated with your PHP installation.

Where your server uses standard Debian or Ubuntu PHP packages, the operating system's normal upgrade process is generally the appropriate way to install the vendor's fixed packages:

sudo apt upgrade

Review the proposed changes before confirming them, particularly on a production server.

If PHP was installed from a third-party repository, a custom package, a source build, or a container image, the update procedure may be different. Follow the security update process for that installation method.

The objective is not simply to run an upgrade command. It is to confirm that the PHP runtime serving the application now contains the relevant security fixes.

What if the server uses an older PHP version?

PHP 8.1 and older are no longer supported by the upstream PHP project.

Some operating-system distributions and long-term-support vendors may provide backported security fixes for particular packages. Verify that your actual package contains the fix.

If you depend on an unsupported PHP branch without a verified security-maintained package, plan a migration to a supported branch rather than assuming that an old application is safe because it still works.

Step 4: Restart the appropriate PHP workers

Installing an updated package is only one part of the process. You also need to make sure the application uses the updated runtime.

For a server using PHP 8.2-FPM, for example:

sudo systemctl restart php8.2-fpm

Use the service name corresponding to your actual PHP-FPM installation.

Check its status:

sudo systemctl status php8.2-fpm --no-pager

If your website runs PHP through Apache's mod_php rather than PHP-FPM, follow the appropriate procedure for that configuration. A typical Apache installation may require:

sudo systemctl restart apache2

Do not run every command blindly. First determine which service actually handles your PHP requests.

Restarting a service can interrupt active requests, so plan the operation appropriately for production.

Step 5: Verify the application after the update

After restarting the relevant service, verify that the application is functioning normally.

For a Laravel application, useful checks include:

Confirm that the PHP service is running.

Check the version or package build of the active runtime.

Load the application's primary pages or health endpoint.

Test login and authentication.

Test important API endpoints.

Confirm that database access and queue processing still work.

Review PHP-FPM and web server logs for errors.

A security update should not be considered complete merely because the package installation succeeded.

Verification helps identify service-startup problems, incompatible extensions, incorrect PHP-FPM socket configuration, and other deployment issues.

Also remember that the CLI and web runtime may differ. Confirm the version used by the actual web application.

Step 6: Understand what Laravel-level security can and cannot do

After reading about a PHP runtime vulnerability, it is natural to wonder whether stronger Laravel validation can prevent the attack.

Consider an ordinary endpoint:

Route::post('/orders', [OrderController::class, 'store']);

You might protect it with authentication middleware and request validation.

Those controls are essential for preventing unauthorized operations and accepting only valid application data.

However, PHP must process the incoming request before Laravel can execute its route middleware or controller.

Therefore, middleware is not a substitute for fixing the underlying PHP vulnerability.

The same applies to updating Composer dependencies:

composer audit

This can help identify known security advisories affecting Composer dependencies. It does not replace checking and patching the PHP runtime itself.

Maintain both layers of security, but handle the PHP runtime issue as a runtime issue.

Step 7: What if an immediate update is not possible?

The PHP advisory describes temporary mitigations for specific attack paths, including controlling request sizes and disabling certain PHP features involved in demonstrated paths.

These measures require careful application to the server configuration. For example, the advisory recommends disabling session upload progress at the PHP configuration or server level, rather than relying on application code that runs later.

Some temporary settings are version-specific, and configuration changes can affect file uploads or other application behavior.

Most importantly, the advisory explicitly states that temporary measures do not provide a complete solution.

If the system cannot be patched promptly, conduct a risk assessment and consider temporarily removing the affected service from public access. Do not rely on an untested workaround to declare the server safe.

Step 8: Review the rest of the production environment

PHP is one component of the application stack.

During the security update, review the other layers as well:

Operating system: Apply relevant security updates and confirm the supported status of the operating system.

Web server: Keep Nginx or Apache updated and review its configuration.

File permissions: Ensure that the web application does not have unnecessary write access to application code or system directories.

Secrets: Keep database passwords, API keys, and application secrets out of publicly accessible locations.

Logging: Retain appropriate web server and PHP logs so suspicious requests and unexpected errors can be investigated.

Backups: Maintain tested backups and confirm that application files and databases can be restored.

These measures do not independently fix PHP2Shell, but they help reduce the wider impact of a server compromise.

Conclusion

Protecting a Laravel application against PHP2Shell starts with identifying the PHP runtime actually serving requests and installing a verified security fix.

Do not stop after running composer update, and do not assume that a secure Laravel controller protects a vulnerable PHP runtime.

Check every PHP version installed on the server, apply the relevant operating-system or upstream update, restart the correct workers, and verify the application afterward.

For production applications, this should be handled as a server security update rather than an ordinary application feature release.