For Discuz! X, PHP2Shell remediation requires patching the PHP runtime. The application version helps identify compatibility blockers; it cannot establish exploitability or prove that either CVE is fixed.
Discuz! X - PHP compatibility for the PHP2Shell fix
A trustworthy release-to-PHP mapping is not available here. Do not guess a PHP 8 target from a product name or a modern download page. Identify the exact distribution, patch level and local modifications first.
Identify the PHP2Shell repair scope
Files and package identity
source/discuz_version.phpconfig/uc_client/source/plugin/
Discuz! X - Remove blockers to patch PHP2Shell
Discuz! X, UCenter and forum plugins need separate version records. The official repository documents multiple builds and encodings, so a generic X3.4/X3.5 label is insufficient for a PHP promise. Use the chosen release package’s requirements and upgrade instructions. Rehearse shared login, user synchronization, attachment access and database encoding; keep a complete forum/UCenter rollback set. For Discuz, restore the forum and UCenter in an isolated matched environment and check whether other sites share that UCenter. Preserve attachment storage and user-ID relationships. Coordinate account writes during final migration, then test login from each connected application; a working forum front page does not establish shared-account consistency.
Dependencies and custom code to review
Official upgrade documentation ↗Check site functions after the PHP2Shell fix
Inventory before fixing PHP2Shell
Use an authorized working copy.
php -v
php --ini
php -mDiscuz! X - PHP2Shell patch verification
Verify both CVE fixes in the PHP actually serving this site. Replace or restart old Web workers, queue workers and replicas. A working homepage or a newer CLI binary is insufficient evidence.
3. Restart and verify every instance ↗