Drupal Sites and Black October: Updating PHP Without Breaking Drupal

By Umair Ali Sadaqat · Updated · Editorial policy

PHP2Shell affects Drupal through PHP itself. How to read the version from the Status report, why Drush can show the wrong number, what to do on Drupal 7, and how to roll the update across several environments.

Drupal teams tend to be good at core security updates, which creates a blind spot this month: PHP2Shell is not a Drupal advisory. The two flaws fixed on 21 October 2026 live in PHP, and a fully patched Drupal on an unpatched PHP is exposed. If you have not read the background, start with the Black October overview.

Read the version Drupal actually runs on

Go to Reports → Status report (/admin/reports/status). The PHP line there comes from the web request, so it reflects the PHP that serves visitors.

Be careful with drush status. Drush runs from the command line, and on many servers the command-line PHP is a different build from the PHP-FPM pool serving the site. A green Drush result does not prove the site is patched. The safe versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12 and later in each line, plus distribution packages that include the backported fix. Other ways to check are in the PHP version guide.

Updating PHP on Drupal 10 and 11

Recent Drupal releases run on PHP 8 branches that received fixed releases, so most sites only need a patch-level update within the same branch:

  1. Update the PHP packages on every web server (and on any separate cron or queue servers).
  2. Restart PHP-FPM, or Apache if you use mod_php.
  3. Clear Drupal's caches (drush cr) so nothing stale is served.
  4. Recheck the Status report on each environment.

If you also need to change PHP branch, check Drupal's published PHP requirements for your core version and test contributed modules on a staging copy first. Composer can help: composer why-not php 8.4 lists packages that block a given PHP version.

Several environments, one rule

Drupal sites often run on development, staging and production, sometimes behind a load balancer with several web nodes. Each one has its own PHP. Patch production first, since it faces the internet, and patch every node behind the balancer, not just the one you happened to log into. Staging and development copies exposed to the internet need the same treatment; a forgotten staging site is a classic way in.

Drupal 7

Drupal 7 reached end of life in January 2025, and many Drupal 7 sites still run on PHP 7.4 or 8.0 or 8.1. Those branches get no official PHP release for these flaws. Your options are a vendor or distribution that backports PHP fixes, building PHP from the PHP team's backport branches (see the old PHP versions guide), or finishing the migration you have probably been postponing.

Things that will not protect you

  • Drupal's own flood control and permission settings act after PHP has parsed the request; the most serious attack path happens earlier.
  • Setting PHP values in settings.php with ini_set() runs too late. The PHP team says the temporary session.upload_progress workaround must be set in php.ini, the FPM pool or the server configuration. See the stopgap guide.

Checking a Drupal site for intruders

  • People page: administrators you do not recognise.
  • sites/default/files: should contain uploads, never .php files. Drupal ships an .htaccess there that blocks running PHP on Apache; confirm it is still present and unchanged.
  • settings.php: check for unfamiliar includes or code.
  • Recently changed files under core, modules and themes outside your deployment history.

If you use Git to deploy, git status on the server is the quickest way to spot files that changed outside a deployment. The compromise checklist covers the rest.

Move your site to WeInc

For a marketing site that no longer needs Drupal's depth, a hosted builder removes the server work entirely. Move your site to WeInc: first month free with code BLACKOCTOBER, until November 21, 2026. New customers only. Claim the offer

More in Blog

Related guides and tools

Start building

How we research, test and update this page: our editorial policy. We.Inc is our own product.

Product

Who It's For

Features

Resources

Company

View Sitemap