For TYPO3, PHP2Shell remediation requires patching the PHP runtime. The application version helps identify compatibility blockers; it cannot establish exploitability or prove that either CVE is fixed.
TYPO3 - PHP compatibility for the PHP2Shell fix
| Release sample | Declared PHP requirement | Declared patch candidates | Original source |
|---|---|---|---|
| v8.7.32 | ^7.0 | None of these patch baselines matches ↗ | repo.packagist.org ↗69f3db31901d |
| v9.5.31 | ^7.2 | None of these patch baselines matches ↗ | repo.packagist.org ↗d167aa730b54 |
| v10.4.37 | ^7.2 | None of these patch baselines matches ↗ | repo.packagist.org ↗34e4a9807eb3 |
| v11.5.41 | ^7.4 || ^8.0 | repo.packagist.org ↗1249ec68101f | |
| v12.4.45 | ^8.1 | repo.packagist.org ↗49b6ea508077 | |
| v13.4.36 | ^8.2 | repo.packagist.org ↗32c043e1907a | |
| v14.0.2 | ^8.2 | repo.packagist.org ↗1e0699c5be36 |
Candidates match only this declaration against the first PHP2Shell fixes on supported branches. They do not establish tested compatibility, vendor support or a complete dependency match. PHP compatibility for the PHP2Shell fix ↗
Identify the PHP2Shell repair scope
Files and package identity
typo3/cms-core
composer.lockconfig/system/typo3conf/ext/
TYPO3 - Remove blockers to patch PHP2Shell
TYPO3 core and extension constraints must move together. Inspect custom extensions, Fluid templates, TypoScript and site configuration before a major upgrade. Use the documented Upgrade Wizards in staging and verify backend editing as well as the public site. A core package minimum does not establish support for every extension or an extended-support contract.
Dependencies and custom code to review
Official upgrade documentation ↗Check site functions after the PHP2Shell fix
Inventory before fixing PHP2Shell
Use an authorized working copy.
php -v
php --ini
composer --no-plugins show --locked typo3/cms-core
composer --no-plugins check-platform-reqs --lock
composer --no-plugins prohibits php 8.3.36 --lockedTYPO3 - PHP2Shell patch verification
Verify both CVE fixes in the PHP actually serving this site. Replace or restart old Web workers, queue workers and replicas. A working homepage or a newer CLI binary is insufficient evidence.
3. Restart and verify every instance ↗