In short: With PHP2Shell, Contao security depends on the server's PHP, not on Contao. Make sure that both the web PHP and the command-line PHP used by the Contao Manager are patched. Then check .env, custom templates, the files folder and the access to the backend and the Manager.
Contao and PHP2Shell: what it is about
Contao is a CMS that is widespread in the German-speaking region and has been built on the Symfony framework since version 4. According to the PHP team, the PHP flaws CVE-2026-109618 and CVE-2026-109619 allow remote code execution without authentication. They affect PHP itself, and therefore every Contao installation on an unpatched server.
Many Contao websites belong to mid-sized companies, associations and municipalities and are looked after by agencies. First clarify who is responsible for PHP: the host, the agency or your own IT.
A common misconception concerns maintenance mode. Contao can lock a website for visitors, but that lock page is itself delivered by PHP. Every request therefore still reaches the PHP interpreter. Maintenance mode consequently does not protect against PHP2Shell. When the BSI (German Federal Office for Information Security) recommends taking web servers offline until the update, it means a block at server or hosting level, not a setting in the CMS.
Contao security begins with two PHP versions
Contao uses PHP in two ways. The web server handles page requests, usually via PHP-FPM. The Contao Manager and the Contao console additionally work with a command-line PHP, for example for installations, updates and cron jobs. On hosting packages with several PHP versions, these can be two different programs.
In its server configuration, the Contao Manager shows which PHP binary it uses. You can see the web version in the hosting panel. Fixed upstream versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; backports can carry older numbers. Both paths must be patched and all processes restarted. Which PHP versions your Contao version supports can be found in the system requirements on contao.org. More on the check under Checking the PHP version and patch level correctly.
Directories and files in Contao
| Location | Content | What to check |
|---|---|---|
.env, .env.local |
Database credentials, APP_SECRET |
Renew if you suspect an incident |
config/config.yaml |
Configuration of the installation | Unexpected changes |
public/ (older versions web/) |
Document root with index.php, Contao Manager file, assets |
Additional PHP files |
files/ |
Editors' file manager | No PHP files |
templates/ |
Custom templates, classically .html5 with PHP |
Unknown or modified templates |
system/config/localconfig.php |
Older settings | Inserted code |
var/ |
Cache and logs | Secure logs, regenerate cache |
templates/ in particular is underestimated: classic Contao templates with the extension .html5 are PHP files. A command inserted into a custom template runs on every page request and survives Contao updates.
Harmless first checks:
# PHP files in the file manager
find files -type f -name "*.php"
# Templates changed since 17 October 2026
find templates -type f -newermt "2026-10-17"
# Check available Contao commands and dependencies
vendor/bin/contao-console list contao
composer audit
The Contao Manager can install packages and thereby bring arbitrary code onto the server. If you suspect an incident, check its user accounts, assign new passwords and remove access for former service providers.
Backend, Manager and extensions
The backend is located at /contao. Check users with administrator rights and user groups with far-reaching permissions, for example for the file manager, templates or user administration. Contao ships with two-factor authentication; use it for all accounts with elevated rights.
Extensions are installed via Composer or through the Contao Manager. Each brings PHP code, and older unmaintained extensions hold up PHP upgrades. On servers with several websites, each installation should run separately so that an incident does not spread to neighbouring sites; more on this under open_basedir and isolation per website.
What a Contao update can and cannot do
A Contao update via the Manager or Composer closes known flaws in Contao and extensions. It does not patch PHP and restarts neither PHP-FPM nor background processes. Custom templates, files in files/ and foreign user accounts remain unchanged. After a switch of the PHP major version, the cache should be regenerated and the website checked in a test environment.
For websites with many editors, a look at the backend permissions is worthwhile after the patch. Anyone who may edit templates can store PHP code in classic .html5 templates. This permission belongs only in the hands of a few technically versed people. The same applies to access to the file manager with upload rights into publicly accessible folders.
How does PHP SOS help?
- We determine the web and CLI PHP of your Contao installation and have the patch and restart confirmed.
- We secure logs, files and database before we change anything.
- We check templates,
files/, the document root, and backend and Manager accounts. - On request, our PHP patch service handles the PHP switch with documentation, coordinated with your agency.
Frequently asked questions
Is Contao affected by PHP2Shell?
Contao itself has no new flaw. But if the website runs on unpatched PHP, it is vulnerable like any PHP application. A Contao update does not close the PHP flaw.
Why is the Contao Manager relevant to security?
The Contao Manager can install, update and remove packages. Anyone with access to it can deploy arbitrary code. Access therefore needs a strong password and few authorised users.
Do Contao templates contain PHP code?
The classic templates with the .html5 extension are PHP templates. Custom templates in the templates folder can therefore contain PHP. You should be able to explain unknown or recently modified templates.