On Wednesday, PHP announced two critical security vulnerabilities, known as PHP2Shell. It's a remote code execution exploit that affects all PHP versions.
You've probably heard about this from other services by now. It was all over X. I received multiple emails from vendors. I also sent one to Shift users since keeping you up-to-date is Shift's goal. This post serves as the public write-up.
tl;dr; If you're running Laravel 8 or lower, start upgrading so you're compatible with a patched and supported version of PHP.
How do I patch PHP?
Patches are available. The immediate step is to get your servers on a patched version of PHP. What that looks like depends on where you host.
If you manage your own server, upgrade PHP immediately. Most distros and repos have received the patches. If you're not sure, run php -v. You need to be running one of these PHP versions or higher:
| PHP | Minimum version |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
If you're on shared hosting, check how your provider is handled the patch. Laravel Cloud and Vapor automatically deployed the patch for all customers. No action is required. Forge requires manual action. If you host with one of Laravel's services, review their official post for more details.
What about older versions of PHP?
While the official release only addresses supported versions of PHP (8.2 and higher), there were source patches available for older PHP versions. Depending on how PHP is installed, you might be able to use one of those as a stopgap.
But PHP versions before 8.2 are end of life. They no longer receive security fixes. So there's no guarantees the next vulnerability will have a patch. This one was considered serious enough for PHP to make an exception. It was really the PHP community that made them available. Otherwise, you'd be compiling source code (thanks Ondřej).
What if I need to upgrade Laravel?
You may need to upgrade Laravel before you upgrade PHP. The earliest version of Laravel to officially support PHP 8.2 is Laravel 9. Laravel 6 was the first version to support PHP 8.
Here's the full table.
| Laravel | Constraint | PHP 8.2 |
|---|---|---|
| 6.x | ^7.2.5|^8.0 |
Unproven |
| 7.x | ^7.2.5|^8.0 |
Unproven |
| 8.x | ^7.3|^8.0 |
Unproven |
| 9.x | ^8.0.2 |
Proven |
| 10.x | ^8.1 |
Proven |
| 12.x | ^8.2 |
Proven |
| 13.x | ^8.3 |
- |
Laravel 6 through 8 are unproven. Their Composer constraints technically allow PHP 8.2, but none of the explicit 8.2 commits were backported. So it's unlikely anything before Laravel 9 will run PHP 8.2.
So if your application is on Laravel 8 or lower, I strongly recommend starting your upgrade now. Of course, the fastest, most thorough way to do that is with Shift.
The most cost-effective path would be to subscribe to the Legacy Plan. It includes all the Shifts you need to upgrade from Laravel 8. If you're on an older version, run the individual Shifts to Laravel 8, then subscribe.
If you don't have the capacity to upgrade your project right now, I'm immediately available for Human Shifts.
Stay up-to-date
PHP2Shell is a reminder of why staying up-to-date matters. In today's AI age, I expect more of these vulnerabilities to be discovered and exploited. As always, Shift recommends upgrade to the latest version of Laravel, currently 13.x, and at least PHP 8.4. That way you're on supported versions of both Laravel and PHP.