Laravel and PHP2Shell

Yes—Laravel applications are affected when running on vulnerable PHP. Fixes are available, but the fix is a PHP runtime update, not a Laravel framework update. These CVEs concern PHP internals, and PHP warns that all installations serving web requests are at risk. Evidence that Laravel is affected The original Calif Research PHP2Shell write-up explicitly lists Laravel 13.11 among applications

Here is a comprehensive summary of what is known about PHP2Shell (CVE-2026-109618 & CVE-2026-109619) and its impact on Laravel: ⚠️ PHP2Shell (CVE-2026-109618 & CVE-2026-109619) — Impact on Laravel What is PHP2Shell? PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of Remote Code Execution vulnerabilities in PHP that let an attacker run their own code on a web server without logging

Yes. Laravel applications can be affected, but the vulnerability is in the underlying PHP runtime, not in Laravel’s framework code. An attacker can exploit vulnerable PHP before Laravel application code runs, so updating Laravel or running composer update does not remediate it. PHP released fixes on October 21, 2026: PHP 8.5.12 PHP 8.4.27 PHP 8.3.36 PHP 8.2.35 Therefore, Laravel

Laravel is not uniquely affected by a framework-specific vulnerability; instead, Laravel applications are affected if they run on a vulnerable version of the underlying PHP runtime (CVE-2026-109618 and CVE-2026-109619). Patch and Fix Details The Flaw: PHP2Shell is a core PHP engine flaw rather than a Laravel code defect. The Fix: The PHP Group released security updates on October 21,

Laravel itself as a PHP framework contains no direct vulnerability code for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), because these are critical core PHP engine vulnerabilities (rated 9.2 CVSS v4.0 for remote code execution via memory/OOM mismanagement). However, any Laravel application running on an unpatched version of PHP is vulnerable. Laravel applications do not need a framework patch; instead, the underlying