Moodle security releases fix Moodle. The PHP shown in Site administration, Server, PHP info, is the engine covered by these CVEs.
What to look at
Moodle’s own PHP requirements change by Moodle branch. Read them from Moodle’s documentation for the branch you run. Cron via CLI may use a different php than the web SAPI on some installers.
Remediation
Patch both paths if they differ. Restart the web SAPI. A large Moodle site should take the PHP restart in a maintenance window because sessions drop. Legacy Moodle on PHP 7.4 should look for a vendor 7.4 backport rather than a forced jump that the installed plugins cannot boot.
Nginx or Apache in front of Moodle is still only the proxy or the module loader. Follow the web server guide that matches the handler you found. Temporary PHP settings remain incomplete if the provider cannot patch this week. CISA’s 21 October 2026 alert said internet-facing PHP that cannot be updated should be taken offline until it can. That is a business decision for a store or a campus site, and it is the alternative to pretending the application update was enough.
Questions
Does updating Moodle fix PHP2Shell?
No. Moodle runs on PHP. The PHP binary or package that serves it has to be patched or replaced.