PHP2Shell and phpBB or Other PHP Forums

As of 23 October 2026, the PHP project has fixed both PHP2Shell flaws in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. We could not confirm whether phpBB has published a statement, because phpbb.com refused automated access when we checked. Exploitation attempts are widely reported, but confirmed successful compromises are not publicly documented, and CISA has not added the flaws to its Known Exploited Vulnerabilities (KEV) catalog.

The direct answer: phpBB, MyBB, Simple Machines Forum (SMF), Flarum, XenForo and self-hosted Invision Community all run on PHP, so all of them are exposed when the PHP under them is unpatched. PHP2Shell is a flaw in PHP itself, not in any forum package, and no forum update fixes it. The fix is a patched PHP build on the server and a restart of every PHP worker.

This guide is for forum owners and volunteer administrators. It covers what is known about each forum, which PHP versions phpBB supports, where to see the PHP version in phpBB and what to do today. For the background, read what PHP2Shell is and who it affects.

Is Your Forum Affected?

If it is self-hosted and written in PHP, yes, until its PHP is patched. PHP's advisory says the risk covers "all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed." On Apache with mod_php, CVE-2026-109618 happens "entirely before any application-specific code begins execution," so the forum's own code never gets a chance to block it.

The Dutch national cyber security centre keeps a public inventory of software that depends on PHP. As of its 23 October update, it lists phpBB, MyBB, Simple Machines Forum, Flarum, XenForo and Invision Community Classic as Vulnerable. For each one, the reason is the same general assessment: "Affected when deployed on an affected web-serving PHP runtime." That is an inference from "it runs on PHP," not a vendor confirmation. For Invision's self-hosted product, the inventory also notes "customer responsibility for server security patches and version upgrades."

Not every forum runs on PHP. Discourse, for example, is written in Ruby, so PHP2Shell doesn't apply to the Discourse application itself. Hosted forum services that run their own servers patch their own infrastructure.

Did Researchers Attack a Forum?

Not publicly. Calif's list of applications where it confirmed unauthenticated remote code execution covers WordPress, Drupal, Joomla, MediaWiki, Roundcube, Magento, phpMyAdmin, Nextcloud, Laravel, Symfony and WHMCS. Wiz demonstrated attacks against WordPress, Drupal and Joomla. No forum package appears in either list.

Wiz says its targets "are representative targets - exploitation does not require one of these CMSs." The bug sits below every PHP application, so a forum is as exposed as the PHP it runs on.

What phpBB and Other Forum Projects Have Said

We could not read phpbb.com: its home page, announcements forum and development site all returned "access denied" to our checks on 23 October. So we can't tell you whether phpBB has posted a PHP2Shell notice. Check the announcements forum on phpbb.com yourself.

What we could verify comes from phpBB's official code repository on GitHub. The newest stable release there is phpBB 3.3.19, tagged in September 2026, and recent commits on the 3.3 branch, from 11 to 22 October, don't mention PHP2Shell. That fits the flaw being in PHP: there is nothing in phpBB to patch.

For the others, as of 23 October 2026:

• MyBB: its blog's newest post is the MyBB 1.8.41 security and maintenance release from 16 September 2026. No PHP2Shell post.
• Flarum: no PHP2Shell post in its blog section on discuss.flarum.org.
• Simple Machines, XenForo and Invision Community: their sites refused automated access, so we could not check. Look for notices on their sites directly.

"No statement found" never means "safe." The authority on the fix is the PHP project's advisory, with your Linux distribution or host.

PHP Requirements for phpBB and Other Forums

These are the PHP versions each project documents, where we could verify them, as of 23 October 2026.

The phpBB 3.3 range matters. It spans PHP 7.2 to 8.3, and everything below 8.2 is end of life upstream, with no official PHP2Shell release. The PHP project published minimal source backports only for 7.4, 8.0 and 8.1, so 7.2 and 7.3 depend entirely on vendor fixes. If your forum runs on PHP 8.1 or older, read PHP 8.1 and PHP2Shell for your options.

How to Check the PHP Version in phpBB

phpBB shows the PHP version in two places in the administration control panel (ACP):

• The ACP front page shows a PHP version line.
• System > General tasks > PHP information shows the full PHP configuration. phpBB warns: "You are advised to not give out any details on this page except when asked by official team members on the support forums." Don't paste it in public.

The number needs care. Linux distributions and hosts backport the fix without changing the upstream version, so a patched Ubuntu 24.04 server still reports PHP 8.3.6 and a patched 8.1 build still says 8.1.34. Check the package version against your distribution's advisory, or ask your host for the build date. Our guide on how to check your PHP version covers each method.

What to Do Today

Who patches depends on where the forum lives. On shared or managed hosting, your host runs PHP. Check its PHP2Shell statement and ask, in writing, whether the PHP serving your forum has the fix and whether workers were restarted. Our guide to PHP2Shell on shared hosting covers what to ask. On your own server or VPS:

1. Back up the database and the forum's files, including uploaded attachments. See website backup and recovery.
2. Install the fixed PHP packages. On Debian or Ubuntu with PHP-FPM, for example (replace 8.3 with your version):
   sudo apt update
   sudo apt upgrade
   sudo systemctl restart php8.3-fpm
   On RHEL-family systems, sudo dnf upgrade, then sudo systemctl restart php-fpm. If Apache runs PHP as mod_php, restart Apache instead (for example sudo systemctl restart apache2).
3. Confirm the build in the ACP or with your host. Never run an unofficial patch script.
4. Check for compromise from at least 17 October 2026. Our guide on checking whether your site was hacked through PHP2Shell lists what to look for.

Old forums are easy to forget: a community board on a subdomain, a legacy support forum nobody has logged into in years. If it is reachable from the internet, it needs the same patch, or it should come down.

Interim Settings and Forum Uploads

PHP's advisory lists settings that reduce exposure if you can't update today, but says they "do not make an installation safe." Set session.upload_progress.enabled=0 in php.ini or the FPM pool and restart every worker. Don't rely on ini_set() or .user.ini. Keep it off after patching, because a separate, unlikely issue (CVE-2026-115560) affects patched builds.

PHP also suggests a lower post_max_size, such as 32M if the site needs uploads. Forums take attachments and avatars, and phpBB's own setting text notes that with a limit of 0, an avatar upload "is only limited by your PHP configuration." Test posting an attachment and changing an avatar afterward. Every option and its trade-offs are in PHP2Shell interim mitigations.

If a compromise is suspected, remember what a forum holds: member accounts and email addresses. Wiz warns that leaked memory "may contain passwords, authentication tokens, API keys and certificates." Rotate the database password and any mail or API keys in the forum's configuration, and consider asking members to reset passwords. Our guide to access control and 2FA covers locking down admin accounts afterward.

Conclusion

As of 23 October 2026, phpBB and every other self-hosted PHP forum are exposed to PHP2Shell only through the PHP they run on, and no forum update can change that. Confirm that the build serving your forum is patched and restarted, keep upload progress off, move phpBB 3.3 boards to PHP 8.2 or 8.3, and find any old forum you forgot. If you need a server patched quickly, see our emergency PHP patching service. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions