For CodeIgniter, PHP2Shell remediation requires patching the PHP runtime. The application version helps identify compatibility blockers; it cannot establish exploitability or prove that either CVE is fixed.
CodeIgniter - PHP compatibility for the PHP2Shell fix
| Release sample | Declared PHP requirement | Declared patch candidates | Original source |
|---|---|---|---|
| v4.1.9 | ^7.3 || ^8.0 | repo.packagist.org ↗4ec623a6b826 | |
| v4.2.12 | ^7.4 || ^8.0 | repo.packagist.org ↗bc3f312a3eba | |
| v4.3.8 | ^7.4 || ^8.0 | repo.packagist.org ↗10c23e96db99 | |
| v4.4.8 | ^7.4 || ^8.0 | repo.packagist.org ↗84ff35989270 | |
| v4.5.8 | ^8.1 | repo.packagist.org ↗80204755e06c | |
| v4.6.5 | ^8.1 | repo.packagist.org ↗116e0919590a | |
| v4.7.5 | ^8.2 | repo.packagist.org ↗a1f129d56df3 |
Candidates match only this declaration against the first PHP2Shell fixes on supported branches. They do not establish tested compatibility, vendor support or a complete dependency match. PHP compatibility for the PHP2Shell fix ↗
Identify the PHP2Shell repair scope
Files and package identity
codeigniter4/framework
composer.locksystem/core/CodeIgniter.phpapp/Config/
CodeIgniter - Remove blockers to patch PHP2Shell
CodeIgniter 3 and CodeIgniter 4 have different application structures. A CI3 site is not upgraded by installing codeigniter4/framework over system/. Identify custom core classes, hooks, session drivers and routing first. The CI4 rows are exact release samples; later minor releases raise PHP requirements. Port configuration and application code in staging, then compare authentication and database behavior.
Dependencies and custom code to review
Official upgrade documentation ↗Check site functions after the PHP2Shell fix
Inventory before fixing PHP2Shell
Use an authorized working copy.
php -v
php --ini
composer --no-plugins show --locked codeigniter4/framework
composer --no-plugins check-platform-reqs --lock
composer --no-plugins prohibits php 8.3.36 --lockedCodeIgniter - PHP2Shell patch verification
Verify both CVE fixes in the PHP actually serving this site. Replace or restart old Web workers, queue workers and replicas. A working homepage or a newer CLI binary is insufficient evidence.
3. Restart and verify every instance ↗