PHP2Shell and Craft CMS, TYPO3 and Statamic

As of 23 October 2026, TYPO3 has published a public service announcement telling every TYPO3 site to update PHP, Craft has published a notice covering its Craft Cloud hosting only, and we found no PHP2Shell notice from Statamic. None of the three was named by the research teams Calif or Wiz, which means they were not publicly tested, not that they are safe.

The direct answer: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a flaw in PHP, the language all three systems run on. In TYPO3's words: "TYPO3 itself is not affected and does not need to be updated." The same logic applies to Craft and Statamic. What protects a self-hosted site is a patched PHP build (8.5.12, 8.4.27, 8.3.36, 8.2.35 or a vendor backport) and a restart of every PHP process.

This guide covers each system's notice, the PHP versions they support, who patches what, and the steps for self-hosted sites. For background on the flaws, read what PHP2Shell is and who it affects.

What Each Project Said

The Dutch national cyber security centre's software inventory lists Craft CMS, TYPO3 13.4 and Statamic CMS as Vulnerable, with the generic note "Affected when deployed on an affected web-serving PHP runtime." That reflects that they run on PHP, not a separate flaw in the CMS code.

One correction to watch for: Craft's Cloud post describes OpenAI as the party "who discovered the vulnerabilities." The PHP Foundation's timeline says the security firm Calif reported first, on 11 August 2026, and both PHP security advisories credit researchers from Calif, Wiz and OpenAI, plus a fourth reporter. Don't rely on the Craft post for discovery credit.

PHP Versions Each System Supports

PHP 8.2 reaches end of life on 31 December 2026. If a TYPO3 or Craft site runs on 8.2, patch it now and plan a move to 8.3 or 8.4. Our fixed versions list has the patched number for every branch and distribution.

Who Patches: Hosted vs Self-Hosted

Craft Cloud

Craft Cloud runs on Bref, which Craft calls "the PHP runtime that powers Craft Cloud." Craft says patched Bref images "became available just over an hour later" after PHP's release and that "all Cloud environments have now been updated to the new images, and are fully protected," except "a small handful of sites with preexisting build issues." If your Cloud project had build problems before 21 October, check its status or contact Craft support.

Self-hosted Craft

Whoever runs the server patches PHP. If you deploy Craft yourself on AWS Lambda with Bref, NCSC-NL lists patched Bref layers as fixed (for example "Bref 3: php-85:21, php-84:24, php-83:24, php-82:26"); update your layer versions and redeploy.

TYPO3

TYPO3: "Your hosting provider may already be updating PHP for you. Please check with them, and if you manage your own server, VPS or Docker containers, update PHP as soon as possible."

Statamic

Statamic installs as a Laravel package, so it inherits Laravel's hosting setup. Laravel Cloud says it patched every running app in place. Laravel Forge customers must click "Update PHP" on each server. Laravel Vapor customers must redeploy. Sites on Laravel Octane with FrankenPHP need the bundled binary re-downloaded, because it "includes its own copy of PHP." Details are in our PHP2Shell and Laravel guide.

Where to See the PHP Version

• TYPO3: "under System Information Toolbar > PHP Version in the backend." TYPO3 adds that "Many hosting providers also display it in their administration panel."
• Craft and Statamic: we did not find a documented admin path in their PHP2Shell material or the requirements pages we read. Check on the server or in your hosting panel, using our guide to checking your PHP version.

Whatever tool you use, remember that distributions and panels often backport the fix without changing the version string. A site showing 8.3.6 on Ubuntu 24.04, for example, can be patched. The package changelog is the proof.

Steps for Self-Hosted Sites

Commands are examples; replace 8.3 with your version and use your distribution's package names.

1. Back up the site and database.
2. Update PHP within your current branch. On Debian or Ubuntu that is typically sudo apt update then sudo apt upgrade. In Docker, rebuild on a fixed base image and redeploy.
3. Restart every PHP process. Example: sudo systemctl restart php8.3-fpm, or restart Apache for mod_php. Restart queue workers too. For Statamic on Octane, restart Octane after replacing the FrankenPHP binary.
4. Turn off session upload progress. Set session.upload_progress.enabled=0 in php.ini or the FPM pool and restart. PHP's 23 October informational advisory (CVE-2026-115560) suggests this "until the next regular bugfix release," even on patched versions.
5. Check the version again in the TYPO3 backend, your panel or on the server.
6. Review logs back to 17 October, the date of the earliest reported exploitation attempt.

If you cannot patch today, see our interim mitigations guide. PHP says those settings "reduce exposure to specific attack paths but do not make an installation safe."

Statamic Static Sites: Is the Build Server Exposed?

Statamic can generate a static site, a folder of plain HTML files. NCSC-NL lists "Statamic static-site generator" as Investigation, not Vulnerable, because PHP runs only at build time. The published HTML files do not run PHP.

The machine that builds the site still runs PHP, and so does any Statamic control panel you use to edit content. Patch those. If a form, search or preview feature sits on a live PHP server, it needs the same fix. Our comparison of static and dynamic website security explains where the risk moves.

What Not to Rely On

• A CMS update. TYPO3 says outright that no TYPO3 update is needed. Craft and Statamic updates do not change the PHP engine either. Keep them current for their own fixes; our guide to security patching and plugin updates covers the routine.
• memory_limit=-1 on a busy site. It is one of PHP's interim measures for CVE-2026-109618, but it removes PHP's memory cap. Craft asks for 256MB or more of PHP memory as a minimum, so treat unlimited memory as a short stopgap and restore your normal limit after patching.
• .htaccess, .user.ini or ini_set(). PHP says not to rely on ini_set() or FPM .user.ini for its mitigations. Use php.ini, the FPM pool or server configuration.
• A headless front end. If your Craft or TYPO3 install serves content to a separate front end, the CMS server still runs PHP. Our headless security guide covers the back-end side.

Conclusion

Craft CMS, TYPO3 and Statamic are all exposed to PHP2Shell through PHP, and none of them fixes it with a CMS release. TYPO3 told every site to update PHP; Craft says Craft Cloud is patched except a few sites with build issues; Statamic sites follow their Laravel hosting setup. For self-hosted sites, update PHP within your branch, restart every PHP process, switch off upload progress and check the version again. If you need help with the server side, see our emergency PHP patching service. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions