2. PHPRunner General questions
  3. [SOLVED] PHP2Shell Exploit affect PHPRunner?
This topic is locked
[SOLVED]

PHP2Shell Exploit affect PHPRunner?

 		10/21/2026 12:14:55
PHPRunner General questions
D
 DealerModules authorDevClub member

Does the current PHP2Shell exploit in the news affect PHPRunner at all or is this more of a server issue?

Thanks
Paul
Sergey Kornilov admin 10/21/2026

It is primarily a PHP runtime/server issue, not a PHPRunner-specific vulnerability.

PHPRunner applications are generated in PHP, so if the server is running a vulnerable PHP version, a PHPRunner app can still be exposed even if the PHPRunner code itself is fine. The newly disclosed PHP2Shell flaws are in core PHP itself, and researchers say they can be triggered independently of the application running on top of PHP.

So for your setup, the key question is:

What PHP version is your Xneelo hosting currently running?

The fixed releases published today are:

PHP 8.2.35
PHP 8.3.36
PHP 8.4.27
PHP 8.5.12
PHP’s own site says these are security releases for CVE-2026-109618 and CVE-2026-109619, and that updating is the only complete fix.

D
 		DealerModules authorDevClub member 10/21/2026

Thanks Sergey. I appreciate your fast response.
Paul
G
 		GJB 10/22/2026

Hi,

What if you're using PHPrunner's built-in web server, which I believe comes bundled with PHP 7.4.30 (PHPrunner 11.3 build 44417)? Or a separate web server using PHP 7.4.x?

Does the vulnerability also affect PHP 7.4? Meaning we'd have to upgrade to PHP 8.x?

Thanks,
Greg
C
 		cristi 10/22/2026

You don't have to upgrade to PHP 8.x - there si also an official patch for 7.x: Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor.

Just compile de official 7.x release source code with the patch and you are golden.