Symfony’s HttpKernel runs inside PHP. Shipping a new Symfony minor release leaves the SAPI untouched.
What to look at
Check the Symfony version’s documented PHP range from Symfony’s own documentation, then compare it with the fixed runtime you want. Cache and log directories must stay writable by the FPM user after a restart.
Remediation
Clear the production cache with the same PHP binary the web uses, not a newer CLI, or you can warm a cache the web user cannot read. Restart FPM after the package update.
Nginx or Apache in front of Symfony is still only the proxy or the module loader. Follow the web server guide that matches the handler you found. Temporary PHP settings remain incomplete if the provider cannot patch this week. CISA’s 21 October 2026 alert said internet-facing PHP that cannot be updated should be taken offline until it can. That is a business decision for a store or a campus site, and it is the alternative to pretending the application update was enough.
Questions
Does updating Symfony fix PHP2Shell?
No. Symfony runs on PHP. The PHP binary or package that serves it has to be patched or replaced.