Laravel runs on PHP, so a Laravel site is affected by PHP2Shell if its server runs PHP older than the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12). Updating Laravel itself doesn't fix it; your host or developer updates PHP. Laravel 12's documentation lists PHP 8.2 or newer as the minimum.
- Laravel runs on PHP
- Yes
- newest fixed release
- 8.5.12
Is Laravel affected by PHP2Shell?
Laravel is a PHP framework. A Laravel app runs on whatever PHP its server provides, usually PHP-FPM behind Nginx, or FrankenPHP. PHP2Shell is a flaw in PHP itself, not in Laravel, so updating Laravel or its plugins doesn't fix it. A Laravel site is affected if its server runs PHP from before the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12), released October 21, 2026.
How to see your PHP version in Laravel
- Ask your developer, or run
php -von the server. - In the app folder,
php artisan aboutlists the PHP version too. - The command line can run a different PHP than the web server, so confirm the version PHP-FPM uses.
Who updates PHP for a Laravel site
Your developer, or a managed platform such as Laravel Cloud or Forge that manages PHP for the server.
Guides for common hosts: Cloudways.
Which PHP version Laravel supports
Laravel 12's documentation lists PHP 8.2 or newer as the minimum. Whatever the line, use its newest release: for PHP2Shell that means 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later.
What PHP Scanner looks for on a Laravel site
PHP Scanner recognizes Laravel from a laravel_session cookie, Livewire scripts in the page, an XSRF-TOKEN cookie, which Laravel often sets. Many Laravel servers hide their PHP version, which is good practice; then your result asks you to paste the version from the steps above for an exact rating.
Questions people ask
Is my Laravel site safe from PHP2Shell?
No outside check can promise that. What you can confirm is that its PHP is a fixed release (8.2.35, 8.3.36, 8.4.27, 8.5.12) or newer. If it is, PHP2Shell's fix is in.
Does updating Laravel fix PHP2Shell?
No. PHP2Shell is in PHP, which your host or developer updates. Keep Laravel updated as well, but it's a separate job.
What PHP version should Laravel run?
Laravel 12's documentation lists PHP 8.2 or newer as the minimum. Use the newest release of whichever line you're on.
My host says PHP is up to date but the version looks old. Why?
Some hosts and Linux distributions add security fixes without changing the version number. Ask your host to confirm in writing that the PHP2Shell fix is applied.
Sources
- Laravel 12 docs: Deployment, server requirements
- PHP: security release announcement, October 21, 2026
Checked against these sources on October 22, 2026. PHP Scanner is a free tool from Catch Digital and is not affiliated with the PHP project.