In short: The TYPO3 PHP vulnerability PHP2Shell does not affect TYPO3 itself but the PHP underneath. A TYPO3 update therefore does not help. Check the PHP status and restart, lock the Install Tool and inspect fileadmin, typo3temp and the installed extensions.
Why TYPO3 site owners should act now
In Germany, TYPO3 is widespread among municipalities, universities, associations and mid-sized companies. Many of these websites have been running stably for years and are rarely touched. That is exactly what makes them vulnerable to PHP2Shell: the flaws CVE-2026-109618 and CVE-2026-109619 are in the PHP interpreter and, according to the PHP team, allow remote code execution without authentication.
The BSI (German Federal Office for Information Security) has declared warning level 3 (orange) and recommends updating immediately. If that is not possible, web servers should be taken offline temporarily. You will find a summary of the official situation under What the BSI recommends on PHP2Shell.
TYPO3 PHP vulnerability: checking the PHP status in the backend
Administrators see the PHP version in TYPO3 in two places: in the system information in the top bar of the backend and under Admin Tools > Environment (in newer versions in the System module). There TYPO3 also checks whether the environment matches the requirements.
Fixed upstream versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Many TYPO3 servers run on Linux distributions that deliver fixes as a backport; the version number then stays the same. What matters are the package status and the operator's confirmation. Which PHP versions your TYPO3 version supports can be found in the system requirements on typo3.org.
Many TYPO3 installations also run the Scheduler via a cron job using the command-line PHP. This CLI PHP can be a different version from the web PHP and must be patched as well. If in doubt, check which PHP path is used in the cron job. In multi-server setups this applies to every single server, including editorial and preview servers, which are often forgotten.
On older authority servers, PHP often still runs as an Apache module. The PHP team rates this operating mode as the highest risk; why is explained in Why mod_php carries the highest risk.
Directories and configuration in TYPO3
The structure depends on the version and the type of installation. Newer installations via Composer separate public and internal files, older classic installations do not.
| Location | Content | What to check |
|---|---|---|
config/system/settings.php or typo3conf/LocalConfiguration.php (older versions) |
Database credentials, encryption key, Install Tool password | Modification date, renew values if you suspect an incident |
fileadmin/ |
Editors' files | PHP files do not belong here |
typo3temp/ |
Writable temporary files | Unexpected PHP files |
typo3conf/ext/ or vendor/ |
Extensions | Unknown or modified extensions |
var/log/ or typo3temp/var/log/ |
Logs | Secure before making changes |
Harmless checks on the command line; please adapt the paths to your installation:
# PHP files in editor and temp directories
find public/fileadmin public/typo3temp -type f -name "*.php"
# Is there an unlock file for the Install Tool lying around?
find . -name "ENABLE_INSTALL_TOOL"
# Show active extensions (Composer installation)
vendor/bin/typo3 extension:list
Prevent the execution of PHP in fileadmin and typo3temp at web server level. That way, a webshell placed there cannot at least be called directly, even if it has made it onto the server.
Backend, Install Tool and extensions
The backend is located at /typo3. Check the backend users for unknown accounts with administrator rights and for accounts of former employees or agencies. TYPO3 also has "system maintainers" with particularly far-reaching rights in the Admin Tools area; this list should be very short.
The Install Tool has its own password. If you suspect an incident, renew it, just like the encryption key. Extensions from the TYPO3 Extension Repository and custom developments are additional code; older custom developments in particular often hold up a PHP upgrade. Record which extensions are really needed.
What a TYPO3 update achieves and what it does not
A TYPO3 update closes known bugs in the core, an extension update closes bugs in the extension. Neither patches PHP, restarts processes or removes a webshell from fileadmin. Even a freshly updated TYPO3 can therefore contain a backdoor from the time before the patch. In addition, a switch to a newer PHP version on old TYPO3 releases may require a TYPO3 upgrade. In that case you need interim protection and a schedule.
For public bodies, documentation comes on top. Record when the patch was applied and when the restart took place, and which checks were carried out with which result. This makes follow-up questions from information security, data protection and auditors easier. Your service provider should also confirm these points to you in writing.
How does PHP SOS help?
- We establish the PHP version, operating mode and backport status of your TYPO3 server and have the restart confirmed.
- We secure logs from 20 October 2026 onward and the current state of files and database.
- We check
fileadmin,typo3temp, configuration, extensions and backend accounts for anomalies. - As part of server hardening, we block PHP execution in upload folders and document the status for your information security.
Frequently asked questions
Do I need to update TYPO3 because of PHP2Shell?
A TYPO3 update does not close PHP2Shell, because the flaw is in the server's PHP. Keep TYPO3 up to date anyway. For PHP2Shell you need a PHP update or a confirmed backport and a restart of all PHP processes.
Where do I see the PHP version in TYPO3?
Administrators see it in the system information in the top bar of the backend and in the Admin Tools area under Environment. TYPO3 does not show whether a backport has been applied; your host or server admin confirms that.
What is the ENABLE_INSTALL_TOOL file?
It unlocks the Install Tool, which can be used to change central settings. In normal operation the file should not exist. If it turns up unexpectedly, that is a reason for a closer check.
Do public authorities using TYPO3 have special obligations?
Public bodies often follow the BSI IT-Grundschutz and requirements of their federal state. Which obligations apply in an individual case should be clarified with your information security and data protection officers.