Technology

Can a static React or Next.js website be affected by PHP2Shell?

PHP Site Audit · Updated 2026-10-25

The direct answer

A genuinely static frontend can be served as HTML, CSS, and JavaScript without running PHP for those page requests. React and Next.js can also be part of systems with server-side components, APIs, and separately hosted backends. The framework name alone cannot establish that the whole website and its integrations have no PHP runtime. Check the deployment and every service endpoint.

A frontend label is not a runtime inventory

React describes a user-interface library; Next.js supports multiple deployment modes. Next.js documentation explains that a static export generates files served by a static web server, while other features require a server runtime. Therefore, ‘React site’ or ‘Next.js site’ does not tell you what code executes on the server.

An owner may have a frontend on one platform and an API, content-management system, webhook receiver, or legacy admin application on another. A public page may fetch data from a separate hostname. PHP2Shell's relevance depends on whether a PHP runtime serves web requests in any in-scope system, not on the JavaScript framework in the browser.

A static export conclusion is deliberately narrow: it applies to the files and host confirmed by the deployment owner. It does not say that a linked login provider, third-party API, administrative dashboard, or separate business system uses the same deployment model. If the site processes sensitive forms, follow the data flow to its destination and ask that service's operator about its runtime.

Map the real deployment

Ask the developer or platform team for a simple architecture map: public domains and subdomains; static hosting or server-rendered frontend; API endpoints; CMS; file-processing or upload services; admin areas; and legacy applications. For each backend, identify its owner and language/runtime. Include staging and production separately.

Check deployment artifacts and infrastructure records rather than inferring from the source repository alone. A repository can contain unused sample code, while a platform can run a service deployed from another repository. Ask for hosting build or image information and whether PHP packages or workers exist in production.

Classify each service with evidence

If the operator confirms that a hostname serves only static files and no PHP-powered backend, then that specific static serving layer does not execute PHP for those files. Record who confirmed it, which hostnames were included, and when. Keep API services and integrations as separate rows.

If any backend uses PHP, ask for its serving package or vendor backport, deployed build, and worker restart evidence. If the inventory is incomplete, say ‘unknown’ and route the question to the deployment owner. Do not turn the absence of a PHP banner or .php suffix into an all-clear.

A practical owner request

Send this to the developer or hosting contact: ‘Please map the production hostnames and API endpoints. For each, identify whether it is static output or a server runtime, who operates it, and whether PHP handles requests or background work. If PHP is present, provide the vendor package/build and security advisory covering the October 2026 PHP issue, plus rollout time. Please flag unknown integrations.’

This asks for evidence without requesting credentials or an unnecessary code dump. If the team does not know, split the work: the frontend developer maps routes, the cloud/hosting owner confirms deployed services, and the vendor confirms managed runtimes.

For a Next.js application, ask which deployment mode is actually published, not merely which framework appears in package files. The official static-export guide describes generated files and calls out server-dependent features it does not support in that mode. A production deployment using server rendering, route handling, or external functions has a different runtime inventory. It may use Node.js rather than PHP, but only the operator can confirm what is deployed and what other services are attached.

For a React single-page application, inspect the service endpoints configured for production and identify who runs them. The browser bundle may call a PHP API on another host, a SaaS endpoint, or no private backend at all. Browser developer tools can show public requests made during normal use, but they will not reveal every background service or private interface. Treat that view as a map to discuss with the service owner, not as a security audit.

Decision checklist

List all hostnames and API destinations.
Confirm static output versus runtime server for each.
Identify third-party or self-hosted backends.
Ask runtime owners about PHP only where relevant.
Mark unverified parts as unknown until an owner checks them.

Common questions

If my Next.js site is statically exported, is that layer affected by PHP2Shell?

A static file server does not execute PHP to serve those files. Verify that no separate PHP backend is in scope.

Does React mean there is no server?

No. React can be used with server rendering or alongside separate APIs. Identify the deployed architecture.

Can an external scan prove there is no PHP backend?

No. A public scan cannot inventory private or separate services and cannot certify the full deployment.