Patch tonight. Migrate to modern, AI-improved.
Is my Drupal site affected by PHP2Shell?
Last updated: 2026-10-23 · Shawn Gants
Probably, unless your PHP is patched. PHP2Shell is in PHP, below Drupal. Your Drupal version and modules don't change the answer, and updating Drupal won't fix it (PSA-2026-10-20, php2shell.uk). Researchers used Drupal as one of the demo targets (php2shell.com).
Find your PHP version in Drupal
Reports → Status report (/admin/reports/status). Drupal 7 shows it in the same place. drush status shows the CLI PHP, which may differ (Drupal Aid, php2shell.uk).
Which PHP versions each Drupal can run
From Drupal.org's PHP requirements:
| Drupal | PHP |
|---|---|
| 10.4–10.6 | 8.1–8.4 |
| 11.1–11.2 | 8.3–8.4 |
| 11.3–11.4 | 8.3–8.5 |
| 12.0 | 8.5 |
Managed Drupal hosting
Pantheon, Acquia and similar hosts manage PHP for you. Check their status page or ask support to confirm the patch and a restart. This page makes no claim about any host's current status.
After patching
Rotate secrets, and check for unknown admin users and unexpected PHP files (Tag1).
Drupal 10 ends December 9, 2026. If you're planning a move anyway, read the Drupal 10 options.
FAQ
Does my Drupal version decide whether PHP2Shell applies?
No. The flaw is in PHP (PSA-2026-10-20).
Where do I see the PHP version Drupal is using?
Reports → Status report. The command-line php -v can be a different build (Drupal Aid).
Sources on this page
- S04: Drupal.org PSA-2026-10-20: Critical PHP update on Wednesday, October 21, 2026
- S12: Drupal Aid: October 21 Critical PHP Security Update — verified (summary on blog index)
- S13: Tag1: PHP2Shell: What PHP Site Owners Should Do Today
- S14: php2shell.com (researcher disclosure site: Wiz, OpenAI Codex Security, Calif) — verified (search extract)
- S18: Drupal.org: PHP requirements (version matrix)
- S39: Drupal Aid blog index (incl. 'Is Your Drupal 10 Site Ready for Drupal 11? 30-Minute Check')
- S42: php2shell.uk: PHP2Shell and Drupal: is my site affected? (independent guide) — verified (search extract)