TYPO3 core updates do not change the PHP package. The reports module shows the web PHP version and is the clue, not the fix.
What to look at
TYPO3 publishes PHP compatibility for each LTS branch. Use TYPO3’s matrix when choosing an upgrade target. Composer-based installs still execute on the system or container PHP.
Remediation
Update that PHP, restart FPM, and hit the login and a cached frontend page. If you run TYPO3 in Docker, rebuild the image. A bind-mounted new core on an old php base image is still the old CVE.
Nginx or Apache in front of TYPO3 is still only the proxy or the module loader. Follow the web server guide that matches the handler you found. Temporary PHP settings remain incomplete if the provider cannot patch this week. CISA’s 21 October 2026 alert said internet-facing PHP that cannot be updated should be taken offline until it can. That is a business decision for a store or a campus site, and it is the alternative to pretending the application update was enough.
Questions
Does updating TYPO3 fix PHP2Shell?
No. TYPO3 runs on PHP. The PHP binary or package that serves it has to be patched or replaced.