PHP2Shell + Drupal end of life: the 12-step checklist

By Shawn Gants, Cprofessionals. Last reviewed: 2026-10-22 PT. The steps are on this page, and you can print it.

Tonight

1. Find the PHP version your web server runs. In Drupal: Reports → Status report (/admin/reports/status). The CLI php -v can differ. (Drupal Aid)
2. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's patched package. (php.net)
3. On PHP 8.1 or older, get a vendor backport or move to a supported branch. The PHP project published source backports for 7.4, 8.0 and 8.1. (php.net)
4. Restart Apache, PHP-FPM and long-running workers. Rebuild Docker images. (Tag1)
5. Confirm with your host in writing. Patched distro builds may still show the old version number. (Tag1)
6. If you cannot patch yet, apply PHP's temporary measures (not a fix) or take the site offline. (php.net, CISA)
7. If you have Cloudflare, make sure the WAF is on and every PHP hostname is proxied. This is a bridge, not a fix. (Cloudflare)

This week

1. Rotate the database password, API keys and admin passwords on servers that ran an affected version. (Tag1)
2. Review logs from October 17, 2026 onward: POSTs containing PHP_SESSION_UPLOAD_PROGRESS, PHP workers spawning shells, unknown PHP files or admin users. (AWS)

This quarter

1. On Drupal 10, end of life is December 9, 2026. (Drupal.org)
2. On PHP 8.2, end of life is December 31, 2026. (php.net) Drupal 11 needs PHP 8.3 or newer. (Drupal.org)
3. Decide: upgrade Drupal, pay for extended support, or migrate off PHP. Free help deciding is the site audit.