Does updating WordPress, Composer packages or plugins fix PHP2Shell?

No. The flaw sits in the PHP runtime before application code runs, so only a PHP upgrade removes it. Rebuilding containers and restarting workers is required for the new runtime to take effect.

Is GitLab.com affected by the 10.0-rated GitLab vulnerability?

GitLab.com and GitLab Dedicated were patched before the public release. The unauthenticated remote code execution issue affects self-managed instances that did not apply the fixed version and the required upgrade path.

Why is the PHP2Shell score 9.2 rather than 10.0?

The 9.2 score on the newest CVSS version reflects the skill needed to build a working exploit. Cloudflare reported seeing attempts, but the difficulty kept the rating below the maximum.

Did the Railway incident share a cause with the PHP and GitLab bugs?

Railway reported no known link. The company described the incident as potentially part of a campaign against AI inference providers, an assessment it has not confirmed.

Does a web application firewall stop PHP2Shell?

A firewall raises the cost of exploitation but does not fix the flaw. Keep rules active and block direct access to the origin, then patch, because only the runtime update closes the hole.

PHP2Shell patch guide: fix PHP and GitLab now

The PHP2Shell patch guide starts with the PHP runtime, not your app: upgrade PHP to a fixed release, restart every worker, then handle self-managed GitLab, Node.js and certificate updates. Updating WordPress, Composer packages or PHP settings leaves the flaw in place because it sits in the PHP worker before your code runs.

FAQ

Does updating WordPress, Composer packages or plugins fix PHP2Shell? No. The flaw sits in the PHP runtime before application code runs, so only a PHP upgrade removes it. Rebuilding containers and restarting workers is required for the new runtime to take effect.

Is GitLab.com affected by the 10.0-rated GitLab vulnerability? GitLab.com and GitLab Dedicated were patched before the public release. The unauthenticated remote code execution issue affects self-managed instances that did not apply the fixed version and the required upgrade path.

Why is the PHP2Shell score 9.2 rather than 10.0? The 9.2 score on the newest CVSS version reflects the skill needed to build a working exploit. Cloudflare reported seeing attempts, but the difficulty kept the rating below the maximum.

Did the Railway incident share a cause with the PHP and GitLab bugs? Railway reported no known link. The company described the incident as potentially part of a campaign against AI inference providers, an assessment it has not confirmed.

Does a web application firewall stop PHP2Shell? A firewall raises the cost of exploitation but does not fix the flaw. Keep rules active and block direct access to the origin, then patch, because only the runtime update closes the hole.

Source video