For Hyperf, PHP2Shell remediation requires patching the PHP runtime. The application version helps identify compatibility blockers; it cannot establish exploitability or prove that either CVE is fixed.
Hyperf - PHP compatibility for the PHP2Shell fix
| Release sample | Declared PHP requirement | Declared patch candidates | Original source |
|---|---|---|---|
| v2.2.33 | >=7.2 | repo.packagist.org ↗49e98fb74721 | |
| v3.0.45 | >=8.0 | repo.packagist.org ↗7ea476d31ffc | |
| v3.1.63 | >=8.1 | repo.packagist.org ↗c2a980881d77 |
Candidates match only this declaration against the first PHP2Shell fixes on supported branches. They do not establish tested compatibility, vendor support or a complete dependency match. PHP compatibility for the PHP2Shell fix ↗
Identify the PHP2Shell repair scope
Files and package identity
hyperf/framework
composer.lockbin/hyperf.phpconfig/autoload/
Hyperf - Remove blockers to patch PHP2Shell
Hyperf runs long-lived workers and often depends on Swoole or OpenSwoole. Align hyperf/* packages, coroutine clients and the extension ABI before changing PHP. Restarting only the reverse proxy leaves old application processes alive. Test connection-pool recovery, queue consumers and scheduled work, then replace every worker using the documented graceful deployment procedure.
Dependencies and custom code to review
Official upgrade documentation ↗Check site functions after the PHP2Shell fix
Inventory before fixing PHP2Shell
Use an authorized working copy.
php -v
php --ini
composer --no-plugins show --locked hyperf/framework
composer --no-plugins check-platform-reqs --lock
composer --no-plugins prohibits php 8.3.36 --locked
php --ri swoole
php --ri openswooleHyperf - PHP2Shell patch verification
Verify both CVE fixes in the PHP actually serving this site. Replace or restart old Web workers, queue workers and replicas. A working homepage or a newer CLI binary is insufficient evidence.
3. Restart and verify every instance ↗