PHP2Shell: Why Laravel Is Safer Than WordPress

On 21 October 2026 the PHP project shipped emergency fixes for two critical vulnerabilities in PHP itself. Researchers have nicknamed the pair PHP2Shell, and the name is not an exaggeration: in the right conditions, an attacker with no login can read your server's memory and run their own code on it.

Every PHP website is exposed until it is patched: WordPress, Drupal, MODX, Magento and Laravel alike. But they are not equally easy to protect, and that is the real story here. A week like this one shows, very clearly, the difference between a site you control and a site that depends on dozens of other people getting things right.

Our view is simple. For a business website or web application that matters, Laravel is the safer foundation, and PHP2Shell is a good illustration of why.

What PHP2Shell is, briefly

PHP2Shell is two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 under CVSS v4.0.

• The bugs are in PHP, not in your application. They sit in how the PHP engine handles file upload requests and recovers from errors, so even well-written code sits on top of the weakness.
• One flaw leaks memory. That memory can hold database passwords, API keys and session tokens.
• Chained together, they allow remote code execution. Researchers demonstrated attacks with no login against WordPress, Drupal, Joomla, Magento, Nextcloud, Symfony and Laravel, among others.
• They go back a decade. Every PHP release since 5.4 is affected by at least one of the two.

Attacks were reported in the wild hours before the fix was published. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, the four PHP versions still officially supported. PHP 8.1 and older get no official release at all. Hold on to that last point, because it is where the platforms start to split.

Why WordPress, Drupal and MODX sites are hardest hit

The flaw is the same everywhere. What differs is how much else is wrong around it, and how hard it is to fix. Plugin-driven CMS platforms struggle on all three fronts.

They get stuck on old PHP

WordPress, Drupal and MODX carry twenty years of themes, plugins and extensions that they are expected to keep working. That ecosystem drags them backwards. A great many live sites still run PHP 7.4, 8.0 or 8.1, not because anyone chose to, but because a plugin, a theme or an old CMS version breaks on anything newer, so the upgrade keeps getting put off.

Those are exactly the versions with no official PHP2Shell fix. Owners of those sites are now hunting for a backported package from their host and hoping it is complete. Drupal 7 is the extreme case: it reached end of life in January 2025, yet plenty of sites still run it with no core security fixes at all.

You are trusting dozens of strangers

This is the heart of it. A typical WordPress, Drupal or MODX site runs dozens of plugins and extensions. Each one is code written by someone you have never met, to their own standard, updated on their own schedule, and running with access to your entire site.

WordPress.org reviews a plugin when it is first submitted, but updates are not audited on an ongoing basis. Some authors are excellent. Some are one developer working evenings. Some quietly abandon their plugin, which carries on running on your site with no more fixes, ever. More often than not, the security of a CMS site depends on other people keeping their code secure.

PHP2Shell makes this concrete. Researchers found that most public exploits fail against a plain PHP installation. To work, they usually need a second weakness in the site itself, typically a bug that lets an attacker make the site load a file it should not. That is a classic plugin bug. Forty plugins from forty authors means forty chances for an attacker to find the missing piece. We covered plugin risk in more depth in our honest look at WordPress security.

The hosting is out of your hands

These platforms very often live on low-cost shared hosting, running PHP inside Apache, which is the setup where a working PHP2Shell exploit was first demonstrated. On shared hosting you cannot update PHP yourself. You wait for your host, and you hope they are quick.

Why Laravel is the safer foundation

You own the code

A Laravel application has no sprawling marketplace of third-party add-ons bolted onto it. The features are built for your business, the code is yours, and you know exactly what is running on the server. When something like PHP2Shell lands, the question "what might this expose?" has a clear answer, because there are no forty mystery plugins to audit. Fewer doors, and you hold the keys to all of them.

Supported Laravel runs on supported PHP

Laravel 12 requires PHP 8.2 or newer, and Laravel 13 requires PHP 8.3 or newer. Every currently supported version of Laravel therefore runs on a branch of PHP that received an official fix on day one. For a maintained Laravel application, the whole response to PHP2Shell is:

1. Update PHP to the patched point release.
2. Restart PHP workers.
3. Run the test suite and confirm everything is healthy.

That is a small, routine job, usually done within hours of the release. No plugin conflicts, no compatibility gamble, no emergency rewrite.

It is built to be upgraded

Laravel releases once a year on a predictable schedule, with clear upgrade guides and tooling to help. Keeping a Laravel app current is a planned, regular task, not an act of faith that twenty plugin authors will all support the new version in time. That predictability is what stops a site drifting onto an unsupported PHP version in the first place.

Secrets and servers are handled properly

Credentials live in environment configuration, not scattered through plugin settings stored in the database. Laravel apps typically run on servers you control, managed with tools like Laravel Forge, rather than on shared hosting you cannot touch. When PHP needs patching, you patch it.

Laravel still needs looking after

In fairness, Laravel is not a magic shield, and pretending otherwise would not help you. A Laravel 6 app on PHP 7.4 that nobody has touched in years is every bit as exposed as a neglected WordPress site. Custom code can have bugs of its own.

The difference is that a Laravel application is designed to be maintained by people who know it, while a CMS site's security is spread across dozens of parties you have never spoken to. Laravel gives you a foundation you can actually keep secure. Keeping it secure still takes someone doing the work:

• PHP itself, on a supported version and patched promptly.
• Laravel, on a supported release, with yearly upgrades planned rather than dodged.
• Dependencies, the Composer and npm packages your app uses, checked and updated regularly.
• The server, operating system, web server, database and caches.
• Monitoring and tested backups, so you notice odd behaviour and can recover if the worst happens.

Small, regular updates are cheap. Moving PHP from 8.3.35 to 8.3.36 is trivial. Jumping a neglected app from PHP 7.4 to 8.4 under pressure is a project. Maintenance is what keeps every future emergency small.

What to do now

If you run a PHP website or application of any kind:

1. Find out which PHP version your live site runs. Your host or developer can tell you in minutes.
2. If it is 8.2 to 8.5, update to the patched release now and restart PHP. Check your host has actually done it, rather than assuming.
3. If it is 8.1 or older, treat it as urgent. Apply a vendor backport if one exists, and plan a move to a supported version.
4. If you cannot patch today, add temporary mitigations at your firewall or web server, and accept they are a stopgap.
5. Consider rotating secrets if your server was exposed while unpatched: database passwords, API keys and, for Laravel, your APP_KEY using APP_PREVIOUS_KEYS so encrypted data still reads.
6. If this week was a scramble, take that seriously. It is a sign the platform, or the way it is looked after, needs rethinking.

Time to move, or time to get help

If you are running WordPress, Drupal or MODX and this week left you unsure whether you are safe, that uncertainty is the problem. A site your business depends on should not rely on a long list of strangers keeping their code secure.

At AugmentBLU we build Laravel applications and move businesses off ageing CMS platforms, keeping your content and your search rankings intact along the way. See how that works for WordPress, Drupal and MODX. Once you are on Laravel, we look after it: supported versions, planned upgrades, monitoring and tested backups, so the next critical vulnerability is a routine update rather than a crisis. Details are on our managed DevOps page.

If you are not sure where you stand, book a free consultation. We will check what your site is running, tell you plainly whether you are exposed, and what it would take to stay safe from here.

AugmentBLU is based in Edinburgh and works across Scotland and the UK. We reply within 24 hours.