PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. This post covers what comes after the update: a triage you can run on a Laravel server, with Docker notes. Commands assume Linux, and paths vary by stack, so adjust them. Everything below is read-only inspection, and none of it replaces a proper forensic process.

Use 2026-10-20 as your cutoff date. That is when the CVE identifiers started circulating, before the patch existed.

1. Confirm the version that serves web traffic

The CLI version is not necessarily the version behind your web server.

php -v php-fpm -v # or php-fpm8.2 -v on Debian/Ubuntu apachectl -M | grep -i php

Enter fullscreen mode

Exit fullscreen mode

If you installed from a distribution package, the version string can look old while the fix is present.…