In short: After PHP2Shell, Craft CMS security depends on the server's PHP, not on Craft. Agencies with many Craft websites in particular should now check every server individually. After the patch and restart, review .env, the security key, devMode, the document root and the comparison of the Project Config.
What PHP2Shell means for Craft websites
Craft CMS is popular with agencies because it offers flexible content models and clean templates. Accordingly, many agencies look after dozens of Craft websites on different servers and hosting packages. According to the PHP team, the PHP flaws CVE-2026-109618 and CVE-2026-109619 allow remote code execution without authentication, regardless of the Craft version.
For agencies, the most important question is therefore organisational: which website runs where, with which PHP, and who is responsible for the update? A list of all installations with host, PHP status and contact person is the first step. How we support agencies with this is described in Security partner for agencies.
Craft CMS security: checking the PHP version
In the Control Panel, Utilities > System Report shows the PHP version, the database and the installed plugins. This is the version the website runs on for the web. The Craft console php craft, queue processing and cron jobs, on the other hand, use the command-line PHP. Both must be patched.
Fixed upstream versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Many hosts apply fixes as a backport; the number then stays the same. Which versions are affected is shown in Which PHP versions are affected?. Which PHP versions your Craft version supports can be found in the system requirements in the documentation on craftcms.com.
Craft processes background tasks in a queue. If it runs as a permanent process under a process manager, this too must be restarted after the PHP update.
Directories and configuration in Craft
| Location | Content | What to check |
|---|---|---|
.env |
Database credentials, CRAFT_SECURITY_KEY, other keys |
Renew values if you suspect an incident |
config/general.php |
devMode, allowAdminChanges, path to the Control Panel |
Inserted PHP code |
config/project/ |
Project Config as YAML | Compare with Git |
web/ |
Document root with index.php, cpresources/, often uploads |
Additional PHP files |
storage/ |
Logs, runtime files, often database backups | Not reachable via the web |
templates/ |
Twig templates | Foreign JavaScript |
modules/, vendor/ |
Custom modules and plugins | Modified files, composer audit |
A frequently overlooked point is storage/backups/. Craft stores database backups there, which can contain complete customer and form data. This folder must never be located below the document root.
Harmless checks on the command line:
# Show differences between Project Config and database
php craft project-config/diff
# PHP files in the document root other than index.php
find web -type f -name "*.php" ! -name "index.php"
composer audit
In production, devMode must be set to false. With devMode switched on, Craft shows detailed error messages with paths and code excerpts, which make attackers' work easier.
Control Panel, users and plugins
By default, the Control Panel is located at /admin. Check which users have administrator rights and remove access for former employees and freelancers. Craft supports two-factor authentication; use it for all accounts with elevated rights.
In production, set allowAdminChanges to false. Fields, sections and plugin settings can then only be changed via the versioned Project Config, and any deviation shows up when compared with Git. Plugins from the Plugin Store bring their own PHP code; check whether they are all still maintained and match the targeted PHP version.
// config/general.php, excerpt for the production environment
'devMode' => false,
'allowAdminChanges' => false,
What a Craft update can and cannot do
An update of Craft or a plugin closes flaws in that code and can enable newer PHP versions. It does not patch PHP, restarts neither PHP-FPM nor the queue, does not renew a leaked security key and does not remove foreign files from web/ or storage/.
For agencies with many Craft installations, repeatability counts above all after the patch. For each website, record which PHP version runs on the web and on the command line, when the restart was confirmed and whether the checks turned up anything unusual. This overview helps with follow-up questions from clients and with future advisories. Also think of publicly reachable staging and development environments. They often run with devMode, older releases and real client data and are easily forgotten during updates. If there is doubt about whether a client site is affected, inform the client factually instead of waiting.
How does PHP SOS help?
- Together with you, we record all Craft installations with host, PHP status and responsibility.
- We have the patch and restart confirmed per server and secure logs from 20 October 2026 onward.
- We check the document root,
storage, configuration, users and the comparison of the Project Config. - On request, we take over the ongoing security care of your client sites in the security maintenance contract, also under your name.
Frequently asked questions
Is Craft CMS affected by PHP2Shell?
Craft CMS itself has no new flaw. It runs on PHP, though, and PHP2Shell sits in PHP. Every Craft installation on an unpatched server is therefore potentially vulnerable, regardless of the Craft version.
Where does Craft show the PHP version?
In the Control Panel under Utilities > System Report. PHP version, database and installed plugins are listed there. A backport that has been applied cannot be recognised from the number; your host confirms that.
What is the security key in Craft and why renew it?
The security key from the .env file is used to sign and encrypt data. Anyone who knows it may be able to forge sessions or form data. If you suspect an incident, you should renew it in coordination with your agency.
What does setting allowAdminChanges to false achieve?
It prevents fields, sections and plugin settings from being changed via the Control Panel in production. Changes then only come through the versioned Project Config, which makes manipulation harder and more visible.