Fix PHP2Shell on your framework, blog or store. Identify the running PHP, check application compatibility, resolve upgrade blockers and verify both CVE-2026-109618 and CVE-2026-109619 fixes.
All applications
Laravel
For an inherited Laravel application, recover composer.lock before changing constraints. Update Illuminate packages as a compatible set and follow each intervening major upgrade guide. Check Horizon, authentication packages, Carbon and filesystem adapters separately. A working home page does not validate serialized queue jobs: drain or coordinate workers, deploy matching code, and restart long-running processes after the interpreter change.
Read guide ↗Symfony
Use the project’s Symfony components and Flex recipes together, not only framework-bundle. Work through deprecations on the source release before crossing a major boundary. Doctrine, Twig, Messenger and security authenticators can block the move even when PHP satisfies the table. Rebuild the container in staging and exercise console workers as well as HTTP routes.
Read guide ↗ThinkPHP
ThinkPHP 5.0, 5.1, 6 and 8 are different migration projects. Identify topthink/framework and the separately installed ORM and template packages; copied framework directories may have no lock file. Review routing, middleware, old behaviors and custom tags. Do not replace only the thinkphp directory in production or treat a minimum PHP declaration as proof of PHP 8 compatibility.
Read guide ↗CodeIgniter
CodeIgniter 3 and CodeIgniter 4 have different application structures. A CI3 site is not upgraded by installing codeigniter4/framework over system/. Identify custom core classes, hooks, session drivers and routing first. The CI4 rows are exact release samples; later minor releases raise PHP requirements. Port configuration and application code in staging, then compare authentication and database behavior.
Read guide ↗Yii
Separate Yii 1, Yii 2 and Yii 3 before choosing any PHP target. The yiisoft/yii2 sample describes one Yii 2 patch, not every 2.0 release or the Yii 1 framework. Check extensions, RBAC rules, ActiveRecord queries, widgets and asset tooling. Migrating between framework generations requires application changes, not just a Composer constraint edit.
Read guide ↗CakePHP
CakePHP 3.10.5 explicitly excludes PHP 8, while the sampled 4.5.12 also sets an upper bound below PHP 8.4. Read the ORM and application migration guides for each major transition. Audit entity signatures, custom finders and separate authentication/authorization plugins. Run representative queries and form submissions; an installation check cannot validate application behavior.
Read guide ↗Laminas / Zend Framework
An old Zend application may contain Zend Framework 1, 2 or 3 and independently versioned components. The table concerns laminas-mvc samples, not blanket Zend compatibility. Inventory namespaces, ServiceManager factories and module configuration before using migration tooling in a copy. Plan abandoned third-party modules separately and verify API responses, sessions and service construction after migration.
Read guide ↗Slim
Slim 3 to 4 changes more than the PHP minimum: PSR-7 implementation, factories, container integration and middleware order require review. The current Slim 3 sample must not be confused with the original Slim 3 minimum. Identify the exact lock file and test error middleware, authentication, request bodies and response emission with the chosen PHP build.
Read guide ↗Phalcon
Phalcon is a compiled PHP extension. Composer updates alone cannot install a matching phalcon.so or Windows DLL. The 5.9 documentation declares PHP 8.1 or newer, but this does not certify every ABI or binary package. Match PHP version, architecture and NTS/ZTS, rebuild or install the vendor-supported extension, and confirm it loads in FPM as well as CLI.
Read guide ↗Hyperf
Hyperf runs long-lived workers and often depends on Swoole or OpenSwoole. Align hyperf/* packages, coroutine clients and the extension ABI before changing PHP. Restarting only the reverse proxy leaves old application processes alive. Test connection-pool recovery, queue consumers and scheduled work, then replace every worker using the documented graceful deployment procedure.
Read guide ↗WordPress
WordPress core, themes and plugins have separate PHP constraints. Identify the installed core in Site Health or version.php and include child themes, must-use plugins and drop-ins in the audit. Update and test a complete copy before switching the domain’s Web PHP. The low minimum in an old core release is not a recommendation to keep an unsupported interpreter.
Read guide ↗WooCommerce
WooCommerce requires a compatible combination of WordPress, PHP, payment plugins and theme overrides. Preserve orders and coordinate a write freeze for final migration. Test the documented database update, HPOS compatibility, Action Scheduler and sandbox payment callbacks. Rolling back PHP alone cannot reverse a changed WooCommerce schema or restore orders written after a backup.
Read guide ↗Drupal
Drupal upgrades must keep core, core-recommended, Drush and contributed modules compatible. Remove deprecated custom APIs before a major move, and test database update hooks and configuration import on a copy. Drupal 7 is not represented by the Drupal 8+ Composer package. Do not treat these package minima as the supported-PHP policy for every later patch.
Read guide ↗Joomla
Use Joomla’s installed manifest and pre-update check to identify core and extension compatibility. Upgrade templates, overrides and third-party plugins along the documented major-version route. A compatibility plugin can help a transition but does not certify every extension. Back up files and database together, test schema updates, then check administrator login and multilingual routing.
Read guide ↗Magento Open Source / Adobe Commerce
For Magento and Adobe Commerce, use the exact edition and patch-level system matrix as well as Composer requirements. Search, database, cache and message-broker versions can block an upgrade. Review custom modules and indexers, build a tested artifact, and schedule the documented maintenance procedure. Validate totals, asynchronous orders and payment callbacks before accepting new orders.
Read guide ↗PrestaShop
PrestaShop’s composer.json minimum is not its full tested-PHP matrix. Check the target release documentation, Symfony dependencies, payment modules, theme and overrides together. Test Update Assistant on a database copy and verify multistore behavior and order history. Keep a matching files-and-database rollback; reverting the PHP selector does not undo a shop schema migration.
Read guide ↗OpenCart
Identify the exact OpenCart distribution and modification system before changing PHP. OCMOD, VQMod, themes and marketplace extensions may depend on a specific OpenCart major. The startup check gives only a lower bound. Rehearse the documented application and database migration, then verify checkout, payment notifications, mail and storage paths before reopening order writes.
Read guide ↗PHPCMS V9
Treat PHPCMS V9 as an inherited application until its distribution and modifications are proven. The historical official site could not be verified during this review, so no universal PHP range is asserted. Inspect database drivers, mysql_* usage, GBK/UTF-8, custom content models and template tags in an offline copy. Preserve attachments and article URLs when repairing or migrating; an online homepage is not an adequate acceptance test. Before exporting PHPCMS content, map category IDs, model IDs, custom fields and attachment references from the actual database; table prefixes vary. Compare representative detail pages and generated paths against the original. Rebuilding only the article text can lose model-specific data and leave image links pointing at the old server.
Read guide ↗DedeCMS / 织梦
Identify original DedeCMS, commercial releases and DedeBIZ forks separately. The current DedeCMS homepage advertises PHP 5.6+, which does not establish a range for every historical 5.7 package. Audit database classes, custom channel models, templates and character encoding offline. Preserve archive/addon tables, uploads and generated article URLs. Do not overwrite a modified production tree with a differently branded distribution. For DedeCMS, inventory the archive table and each enabled channel’s additional table before export; verify the real prefix and relationship keys in your installation. Preserve author/category mappings, template rules and static output paths. Compare record counts and several full articles with images after import; an archives-only export can omit extended fields.
Read guide ↗Discuz! X
Discuz! X, UCenter and forum plugins need separate version records. The official repository documents multiple builds and encodings, so a generic X3.4/X3.5 label is insufficient for a PHP promise. Use the chosen release package’s requirements and upgrade instructions. Rehearse shared login, user synchronization, attachment access and database encoding; keep a complete forum/UCenter rollback set. For Discuz, restore the forum and UCenter in an isolated matched environment and check whether other sites share that UCenter. Preserve attachment storage and user-ID relationships. Coordinate account writes during final migration, then test login from each connected application; a working forum front page does not establish shared-account consistency.
Read guide ↗Typecho
Typecho’s README provides a minimum for each sampled tag, not an assurance for every theme or plugin. Inspect plugin hooks, theme functions, database adapters and custom routing before changing PHP. Back up the database and usr/ together. After the official update process, compare permalinks, comments, Markdown rendering and uploaded media with the original site.
Read guide ↗EC-CUBE
EC-CUBE upgrades combine Symfony, Doctrine and version-specific plugins. Compare the exact 4.x release and each payment plugin before editing Composer constraints. Customizations under app/Customize and Twig templates can break independently of core. Test documented database migrations, shipping and tax calculations, Japanese text handling and sandbox payment returns before the production change.
Read guide ↗TYPO3
TYPO3 core and extension constraints must move together. Inspect custom extensions, Fluid templates, TypoScript and site configuration before a major upgrade. Use the documented Upgrade Wizards in staging and verify backend editing as well as the public site. A core package minimum does not establish support for every extension or an extended-support contract.
Read guide ↗Shopware
Shopware minor and patch versions matter alongside PHP. Inventory custom apps, plugins and Symfony dependencies, then follow the documented update sequence. Rebuild Administration/storefront assets where required and restart message consumers. Test search indexing, checkout and integration APIs on a database copy; a passing Composer solve does not prove the store can process orders.
Read guide ↗Remove blockers to patch PHP2Shell
PHP2Shell repair for an unmaintained PHP site
Need to fix PHP2Shell on a site with no PHP developer? Recover access, test backups and identify the runtime before choosing a patched build, migration or static archive.
PHP2Shell repair - solve PHP upgrade errors
Resolve errors blocking your PHP2Shell fix: removed APIs, dependency conflicts, missing extensions and gateway failures. Restore service using a patched PHP runtime and verify both CVEs.
PHP compatibility for the PHP2Shell fix
These are selected release samples, not compatibility promises for an entire major version. A minimum without an upper bound does not prove support for every newer PHP. Check the exact lock file, extensions and current vendor support policy.
Inventory before fixing PHP2Shell
Use an authorized working copy. These commands inventory the CLI environment and locked packages; they do not patch PHP or verify the Web runtime. The PHP version in the prohibits example is a comparison target, not a universal recommendation.
PHP2Shell patch verification
Application compatibility, application support and PHP security are separate checks. Choose a supported PHP branch with both CVE fixes, then verify every Web worker, scheduled task and replica. Updating a framework or plugin alone does not replace the PHP interpreter.
| PHP branch | Upstream releases below | First patched release | Security support ends |
|---|---|---|---|
| PHP 8.5 | < 8.5.12 | ✓ 8.5.12 | Dec 31, 2029 |
| PHP 8.4 | < 8.4.27 | ✓ 8.4.27 | Dec 31, 2028 |
| PHP 8.3 | < 8.3.36 | ✓ 8.3.36 | Dec 31, 2027 |
| PHP 8.2 | < 8.2.35 | ✓ 8.2.35 | Dec 31, 2026 |
No normal PHP project release is available for these branches. Minimal source backports exist for 7.4, 8.0 and 8.1; vendor support must be verified separately. Read guide ↗