Adobe Commerce and Magento Open Source execute on PHP. A composer update of the application code does not patch the php-fpm used by the vhost.
What to look at
Adobe publishes its own PHP support matrix. Use that matrix from Adobe, not a number restated here from memory, before you select 8.3 or 8.4. Indexers and cron run PHP too, sometimes from a different CLI path than the web.
Remediation
Patch the web SAPI and the CLI used by cron so you do not leave a second binary behind. Restart FPM and the consumers. Plan the restart around checkout. A failed indexer after the change is a compatibility issue to roll back and retest, not proof the old PHP was safer.
Nginx or Apache in front of Magento and Adobe Commerce is still only the proxy or the module loader. Follow the web server guide that matches the handler you found. Temporary PHP settings remain incomplete if the provider cannot patch this week. CISA’s 21 October 2026 alert said internet-facing PHP that cannot be updated should be taken offline until it can. That is a business decision for a store or a campus site, and it is the alternative to pretending the application update was enough.
Questions
Does updating Magento and Adobe Commerce fix PHP2Shell?
No. Magento and Adobe Commerce runs on PHP. The PHP binary or package that serves it has to be patched or replaced.