For Drupal, PHP2Shell remediation requires patching the PHP runtime. The application version helps identify compatibility blockers; it cannot establish exploitability or prove that either CVE is fixed.
Drupal - PHP compatibility for the PHP2Shell fix
| Release sample | Declared PHP requirement | Declared patch candidates | Original source |
|---|---|---|---|
| 8.9.20 | ^7.0.8 | None of these patch baselines matches ↗ | repo.packagist.org ↗39e2e1c32498 |
| 9.5.11 | >=7.3.0 | repo.packagist.org ↗8afcb233c2a7 | |
| 10.5.12 | >=8.1.0 | repo.packagist.org ↗b4ed85e1c00b | |
| 10.6.20 | >=8.1.0 | repo.packagist.org ↗588d0bd03df6 | |
| 11.2.14 | >=8.3.0 | repo.packagist.org ↗c0ccc1f71339 | |
| 11.3.20 | >=8.3.0 | repo.packagist.org ↗530d0e07c0b4 |
Candidates match only this declaration against the first PHP2Shell fixes on supported branches. They do not establish tested compatibility, vendor support or a complete dependency match. PHP compatibility for the PHP2Shell fix ↗
Identify the PHP2Shell repair scope
Files and package identity
drupal/core
composer.lockweb/core/web/modules/custom/
Drupal - Remove blockers to patch PHP2Shell
Drupal upgrades must keep core, core-recommended, Drush and contributed modules compatible. Remove deprecated custom APIs before a major move, and test database update hooks and configuration import on a copy. Drupal 7 is not represented by the Drupal 8+ Composer package. Do not treat these package minima as the supported-PHP policy for every later patch.
Dependencies and custom code to review
Official upgrade documentation ↗Check site functions after the PHP2Shell fix
Inventory before fixing PHP2Shell
Use an authorized working copy.
php -v
php --ini
composer --no-plugins show --locked drupal/core
composer --no-plugins check-platform-reqs --lock
composer --no-plugins prohibits php 8.3.36 --lockedDrupal - PHP2Shell patch verification
Verify both CVE fixes in the PHP actually serving this site. Replace or restart old Web workers, queue workers and replicas. A working homepage or a newer CLI binary is insufficient evidence.
3. Restart and verify every instance ↗