Nextcloud’s updater patches the application. The PHP version Nextcloud reports under Administration, Overview, is the runtime that still needs a PHP2Shell decision.
What to look at
Nextcloud documents a supported PHP range per major release. Confirm that range in Nextcloud’s admin manual before moving major PHP versions. The web server snippet they ship is usually PHP-FPM.
Remediation
Install the fixed PHP package for the reported branch, restart php-fpm, and run occ status with the same PHP binary. occ on a different CLI can succeed while the web still uses the old socket.
Nginx or Apache in front of Nextcloud is still only the proxy or the module loader. Follow the web server guide that matches the handler you found. Temporary PHP settings remain incomplete if the provider cannot patch this week. CISA’s 21 October 2026 alert said internet-facing PHP that cannot be updated should be taken offline until it can. That is a business decision for a store or a campus site, and it is the alternative to pretending the application update was enough.
Questions
Does updating Nextcloud fix PHP2Shell?
No. Nextcloud runs on PHP. The PHP binary or package that serves it has to be patched or replaced.