Drupal core security releases fix Drupal. PHP2Shell is below that, in the engine that executes index.php.
What to look at
Drupal’s status report shows a PHP version string. Confirm it against the host’s FPM pool or the platform PHP, especially on Pantheon-style or shared hosts where SSH php and the web php differ.
Remediation
Update the runtime the status report’s web request actually used. Run Drupal’s update database and a page cache clear after the restart if the application needs it. Those steps are application hygiene. They are not the CVE fix.
Nginx or Apache in front of Drupal is still only the proxy or the module loader. Follow the web server guide that matches the handler you found. Temporary PHP settings remain incomplete if the provider cannot patch this week. CISA’s 21 October 2026 alert said internet-facing PHP that cannot be updated should be taken offline until it can. That is a business decision for a store or a campus site, and it is the alternative to pretending the application update was enough.
Questions
Does updating Drupal fix PHP2Shell?
No. Drupal runs on PHP. The PHP binary or package that serves it has to be patched or replaced.