https://reddit.com/r/cybersecurity/comments/1xf3i0w/php2shell_google_and_mandiant_warn_that_php/: PHP2Shell: Google and Mandiant Warn That PHP Servers May Remain Vulnerable After Installing Patches

Q: Does installing a patched PHP package immediately protect a running web application?

No. Older PHP processes can remain active in memory after packages are updated, so the relevant web-serving services must be restarted for the application to use the patched runtime.

Q: What should responders do before restarting a server suspected of compromise?

Preserve volatile forensic evidence before restarting the server. Restarting may remove evidence held in memory by the running PHP processes.

Q: Which upstream PHP releases contain the initial fixes?

For supported upstream branches, the initial fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Distribution-specific security backports may use different version numbers.

Q: How far back should logs be reviewed during an investigation?

Review logs dating back to October 17. Google also announced detection capabilities for identifying potentially vulnerable systems and suspicious activity.

Published Oct 25, 2026

Updated

Affected Software

1 affected component

PHP PHP<8.2.35, <8.3.36, <8.4.27, <8.5.12

Frequently Asked Questions

Does installing a patched PHP package immediately protect a running web application?

No. Older PHP processes can remain active in memory after packages are updated, so the relevant web-serving services must be restarted for the application to use the patched runtime.

What should responders do before restarting a server suspected of compromise?

Preserve volatile forensic evidence before restarting the server. Restarting may remove evidence held in memory by the running PHP processes.

Which upstream PHP releases contain the initial fixes?

For supported upstream branches, the initial fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Distribution-specific security backports may use different version numbers.

How far back should logs be reviewed during an investigation?

Review logs dating back to October 17. Google also announced detection capabilities for identifying potentially vulnerable systems and suspicious activity.