For Laminas / Zend Framework, PHP2Shell remediation requires patching the PHP runtime. The application version helps identify compatibility blockers; it cannot establish exploitability or prove that either CVE is fixed.
Laminas / Zend Framework - PHP compatibility for the PHP2Shell fix
| Release sample | Declared PHP requirement | Declared patch candidates | Original source |
|---|---|---|---|
| 3.6.1 | ~8.0.0 || ~8.1.0 || ~8.2.0 | repo.packagist.org ↗f12e801c31c0 | |
| 3.7.0 | ~8.1.0 || ~8.2.0 || ~8.3.0 | repo.packagist.org ↗3f65447addf4 | |
| 3.8.0 | ~8.1.0 || ~8.2.0 || ~8.3.0 || ~8.4.0 | repo.packagist.org ↗53ba28b7222d |
Candidates match only this declaration against the first PHP2Shell fixes on supported branches. They do not establish tested compatibility, vendor support or a complete dependency match. PHP compatibility for the PHP2Shell fix ↗
Identify the PHP2Shell repair scope
Files and package identity
laminas/laminas-mvc
composer.lockconfig/modules.config.phpmodule/
Laminas / Zend Framework - Remove blockers to patch PHP2Shell
An old Zend application may contain Zend Framework 1, 2 or 3 and independently versioned components. The table concerns laminas-mvc samples, not blanket Zend compatibility. Inventory namespaces, ServiceManager factories and module configuration before using migration tooling in a copy. Plan abandoned third-party modules separately and verify API responses, sessions and service construction after migration.
Dependencies and custom code to review
Official upgrade documentation ↗Check site functions after the PHP2Shell fix
Inventory before fixing PHP2Shell
Use an authorized working copy.
php -v
php --ini
composer --no-plugins show --locked laminas/laminas-mvc
composer --no-plugins check-platform-reqs --lock
composer --no-plugins prohibits php 8.3.36 --lockedLaminas / Zend Framework - PHP2Shell patch verification
Verify both CVE fixes in the PHP actually serving this site. Replace or restart old Web workers, queue workers and replicas. A working homepage or a newer CLI binary is insufficient evidence.
3. Restart and verify every instance ↗