PHP runtime — Glossary

The longer version

When someone visits a PHP site, something has to execute the scripts. That something is the runtime. It includes the core engine, extensions such as those for databases and images, the configuration in php.ini, and the SAPI that talks to the web server or the command line.

This is different from your application. A site's own code, whether WordPress, Laravel or a custom app, runs on top of the runtime. The runtime is shared by everything on the server, so a flaw in it can affect every site there, however well each application is written.

PHP2Shell is a runtime flaw. It sits in PHP itself, and PHP's advisory lists the common ways of running PHP for the web as affected. Fixing it means updating the runtime to a patched version, not changing the application.

A server can have more than one runtime at once, for example several PHP versions side by side, or a command-line PHP that differs from the one the web server uses. To check exposure, find out which runtime actually serves your web requests, and keep each one updated.

Where we use “PHP runtime”

CybersecurityPHP2Shell Workarounds for PHP 8.1 and Older
PHP 8.1 and older got no official PHP2Shell releases, so protection depends on a documented vendor backport. Here is what temporary mitigations can and can’t do, and how to cut exposure while you migrate.
Nov 5, 2026
CybersecurityDoes Updating WordPress Fix PHP2Shell?
A WordPress update does not fix PHP2Shell, because the flaws sit in the PHP runtime that handles requests before WordPress runs. Here is how to check your build, what to ask your host, and which separate WordPress fixes still apply.
Nov 5, 2026

The longer version

Where we use “PHP runtime”

Get the Core in your inbox.