PHP2Shell CVE-2026-109618 / 109619 · WordPress and Drupal hosts should update PHP now.

Patch guide for your host
DrupalMigration.aiPatch tonight. Migrate to modern, AI-improved.

Patch tonight. Migrate to modern, AI-improved.

PHP versions and Drupal

Last updated: 2026-10-23 · Shawn Gants

PHP 8.2 security support ends December 31, 2026. Installing 8.2.35 fixes PHP2Shell and does not move that date. Drupal 11 needs PHP 8.3 or newer. Drupal 12.0 lists PHP 8.5 only.
DrupalPHP it can runSource
10.x8.1–8.4Drupal.org PHP requirements
11.x8.3+Drupal.org PHP requirements
12.08.5 only, on the published matrixDrupal.org PHP requirements
PHP branchPHP2Shell fixSupport note
8.58.5.12php.net, October 21, 2026
8.48.4.27same
8.38.3.36same
8.28.2.35Security support ends December 31, 2026 (php.net)
8.1 and olderNo normal PHP project releaseMinimal source backports for 7.4, 8.0 and 8.1 (php.net)

A version string with a distribution suffix can be patched and still look old. The in-browser check says "can't tell" in that case.

Sources on this page

  1. S02: php.net News Archive 2026: Security advisory + 8.5.12/8.4.27/8.3.36/8.2.35 release notes
  2. S18: Drupal.org: PHP requirements (version matrix)