# Contao Security After PHP2Shell: Securing Websites Properly

> Contao security after PHP2Shell: check PHP for the web and Contao Manager, review .env and templates, protect backend and Manager access.

Source: https://phpsos.de/en/plattformen/contao/  
As of: 25/10/2026  
Provider: PHP SOS, PHP emergency help and server security. Immediate help via WhatsApp: https://wa.me/491736494914?text=Hello%20PHP%20SOS%2C%20we%20need%20help%20with%20our%20PHP%20server.%20Company%3A%20%E2%80%A6%20Website%3A%20%E2%80%A6

**In short:** With PHP2Shell, Contao security depends on the server's PHP, not on Contao. Make sure that both the web PHP and the command-line PHP used by the Contao Manager are patched. Then check `.env`, custom templates, the `files` folder and the access to the backend and the Manager.

## Contao and PHP2Shell: what it is about

Contao is a CMS that is widespread in the German-speaking region and has been built on the Symfony framework since version 4. According to the PHP team, the PHP flaws CVE-2026-109618 and CVE-2026-109619 allow remote code execution without authentication. They affect PHP itself, and therefore every Contao installation on an unpatched server.

Many Contao websites belong to mid-sized companies, associations and municipalities and are looked after by agencies. First clarify who is responsible for PHP: the host, the agency or your own IT.

A common misconception concerns maintenance mode. Contao can lock a website for visitors, but that lock page is itself delivered by PHP. Every request therefore still reaches the PHP interpreter. Maintenance mode consequently does not protect against PHP2Shell. When the BSI (German Federal Office for Information Security) recommends taking web servers offline until the update, it means a block at server or hosting level, not a setting in the CMS.

## Contao security begins with two PHP versions

Contao uses PHP in two ways. The web server handles page requests, usually via PHP-FPM. The Contao Manager and the Contao console additionally work with a command-line PHP, for example for installations, updates and cron jobs. On hosting packages with several PHP versions, these can be two different programs.

In its server configuration, the Contao Manager shows which PHP binary it uses. You can see the web version in the hosting panel. Fixed upstream versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; backports can carry older numbers. Both paths must be patched and all processes restarted. Which PHP versions your Contao version supports can be found in the system requirements on contao.org. More on the check under [Checking the PHP version and patch level correctly](https://phpsos.de/en/php2shell/php-version-pruefen/).

## Directories and files in Contao

| Location | Content | What to check |
|---|---|---|
| `.env`, `.env.local` | Database credentials, `APP_SECRET` | Renew if you suspect an incident |
| `config/config.yaml` | Configuration of the installation | Unexpected changes |
| `public/` (older versions `web/`) | Document root with `index.php`, Contao Manager file, assets | Additional PHP files |
| `files/` | Editors' file manager | No PHP files |
| `templates/` | Custom templates, classically `.html5` with PHP | Unknown or modified templates |
| `system/config/localconfig.php` | Older settings | Inserted code |
| `var/` | Cache and logs | Secure logs, regenerate cache |

`templates/` in particular is underestimated: classic Contao templates with the extension `.html5` are PHP files. A command inserted into a custom template runs on every page request and survives Contao updates.

Harmless first checks:

```bash
# PHP files in the file manager
find files -type f -name "*.php"
# Templates changed since 17 October 2026
find templates -type f -newermt "2026-10-17"
# Check available Contao commands and dependencies
vendor/bin/contao-console list contao
composer audit
```

> **Important:**
> The Contao Manager can install packages and thereby bring arbitrary code onto the server. If you suspect an incident, check its user accounts, assign new passwords and remove access for former service providers.

## Backend, Manager and extensions

The backend is located at `/contao`. Check users with administrator rights and user groups with far-reaching permissions, for example for the file manager, templates or user administration. Contao ships with two-factor authentication; use it for all accounts with elevated rights.

Extensions are installed via Composer or through the Contao Manager. Each brings PHP code, and older unmaintained extensions hold up PHP upgrades. On servers with several websites, each installation should run separately so that an incident does not spread to neighbouring sites; more on this under [open_basedir and isolation per website](https://phpsos.de/en/ratgeber/open-basedir/).

## What a Contao update can and cannot do

A Contao update via the Manager or Composer closes known flaws in Contao and extensions. It does not patch PHP and restarts neither PHP-FPM nor background processes. Custom templates, files in `files/` and foreign user accounts remain unchanged. After a switch of the PHP major version, the cache should be regenerated and the website checked in a test environment.

For websites with many editors, a look at the backend permissions is worthwhile after the patch. Anyone who may edit templates can store PHP code in classic `.html5` templates. This permission belongs only in the hands of a few technically versed people. The same applies to access to the file manager with upload rights into publicly accessible folders.

## How does PHP SOS help?

- We determine the web and CLI PHP of your Contao installation and have the patch and restart confirmed.
- We secure logs, files and database before we change anything.
- We check templates, `files/`, the document root, and backend and Manager accounts.
- On request, our [PHP patch service](https://phpsos.de/en/leistungen/php-patch-service/) handles the PHP switch with documentation, coordinated with your agency.


## Frequently asked questions

**Is Contao affected by PHP2Shell?**  
Contao itself has no new flaw. But if the website runs on unpatched PHP, it is vulnerable like any PHP application. A Contao update does not close the PHP flaw.

**Why is the Contao Manager relevant to security?**  
The Contao Manager can install, update and remove packages. Anyone with access to it can deploy arbitrary code. Access therefore needs a strong password and few authorised users.

**Do Contao templates contain PHP code?**  
The classic templates with the .html5 extension are PHP templates. Custom templates in the templates folder can therefore contain PHP. You should be able to explain unknown or recently modified templates.

## Sources

- [php.net: Security announcements](https://www.php.net/)
- [Contao](https://contao.org/)
- [Supported PHP versions](https://www.php.net/supported-versions.php)
- [OWASP Cheat Sheets](https://cheatsheetseries.owasp.org/)