PHP2Shell attacks: how to check and protect a WordPress or Joomla website
Your website may look normal after the news about PHP vulnerabilities. It is still worth checking whether your host has installed the patch and whether there are signs of tampering. Here is where to start and when website recovery may be needed.
PHP2Shell affects the server environment. Updating WordPress, Joomla or plugins does not replace installing the PHP security patch.
Not sure whether your website is protected?
I can check PHP and the patch status, assess CMS compatibility and help with the update. If the website has been hacked, I can investigate the cause, remove malicious code and help restore it.
You work directly with me. We agree on scope, cost and timing before work starts.
What happened in October 2026
On 21 October, PHP released updates fixing two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Under certain conditions, they allow code to run on a server without logging into the CMS.
The problem is in PHP, which powers many websites and shops. It affects WordPress, Joomla and other PHP applications. The server environment needs checking, not just the CMS version.
On 22 October, Imperva reported 482,342 requests targeting 21,998 websites in 103 countries during its first 24 hours of observation. These are one provider's figures for scanning and exploitation attempts. They do not mean that all those websites were compromised.
Its appearance does not confirm that the patch is installed. Equally, a vulnerability announcement does not prove that your website has been hacked. Check the version and patch status; if there are concerns, investigate the files and logs.
What to do in your situation
01 The website works, but you do not know its PHP version
Check which PHP handler serves your domain in the hosting panel and ask for confirmation of the patch. If the answer is unclear, send it to me so we can discuss what needs checking.
02 PHP is old and the website has not been updated for a long time
First assess compatibility with the CMS, theme, extensions and custom code. Prepare a backup and a rollback plan. For an older shop, test the change on a separate copy before changing the live environment.
03 Redirects, unfamiliar files or spam have appeared
The website needs a compromise assessment. Updating PHP closes the vulnerability, but it does not remove malicious code already uploaded or reverse changes to the database.
How to check the PHP version and patch status
Start with the settings for the specific domain in your hosting panel. Domains and subdomains on the same account may use different PHP handlers. The command-line version can also differ from the one serving the website.
For supported branches, PHP released these fixes on 21 October:
| Branch | Patched release |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
Server package vendors may backport fixes without changing the base PHP version. A label such as “PHP 8.3” is therefore insufficient: check the exact build and whether the vendor has applied the patch.
For PHP 8.1 and older, ask your provider about patch availability and a migration plan to a supported branch. A patch from an individual vendor does not restore long-term support from the PHP project itself.
Older extensions, forms or payments may stop working after the switch. Back up the files and database, check compatibility and make sure you can restore the working configuration before changing anything.
What to write to hosting support
You can send this request, replacing the placeholder with your domain:
Hello. Please check the domain [your domain] for the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619.
Which exact PHP version and build serve this domain? Have the fixes for both vulnerabilities been installed, and have the worker processes been restarted since the update?
If the patch has not yet been installed, what is the update procedure and how should I prepare for website compatibility? Please also tell me where logs from before the update are available.
You do not need to send passwords or access keys in your first message.
If the answer is “protection is enabled”, ask whether this means PHP has been patched or only that requests are being filtered. PHP's developers state that temporary mitigations do not replace an update.
Not sure what your host's reply means? Discuss a check →What to do if there are signs of a hack
Redirects to another website, new administrator accounts, unfamiliar PHP files, altered pages or a hosting warning need investigation. Different vulnerabilities can cause an infection, so it cannot automatically be attributed to PHP2Shell.
- Limit the damage. If there are malicious redirects or data theft, discuss temporarily restricting access to the affected website with your host.
- Preserve evidence for investigation. Make a separate copy of the current files, database and available logs. Label it as potentially infected.
- Do not blindly restore an old backup. It may already contain malicious code, and rolling back a shop may lose recent orders.
- Identify the cause and address the consequences. Check files, the database, users, scheduled tasks and ways an attacker could regain access.
- Update the environment and credentials. After cleanup, change affected passwords and keys, check permissions and monitor for recurring changes.
Also test form submissions, order emails and payments. Even after a redirect is removed, the website may still fail for customers.
Read more: what to do after a Joomla hack and how to remove a malicious redirect.
How I can help with your website
I work on website improvements and maintenance. You can contact me about WordPress, Joomla or another PHP system. I will first review the task and available fixes, then we can agree on the work.
PHP checks and updates
- Confirming the version, build and patch status.
- Assessing CMS and extension compatibility.
- Preparing a backup and update procedure.
- Updating or coordinating with your host within the agreed access permissions.
- Testing pages, forms and agreed shop workflows.
Recovery after a hack
- Investigating signs of infection and available logs.
- Finding and removing malicious code.
- Checking the cause of infection and ways to regain access.
- Restoring the agreed website functions.
- Recommendations for further protection and monitoring.
After the work, you receive a description of the problem found, the changes made and the checks performed. If further development or help from the host is needed, I will explain what is required.
The cost depends on the website's condition, access, compatibility and recovery scope. Additional work and paid tools are agreed before they are used.
Discuss my websiteFrequently asked questions
WordPress and my plugins are up to date. Does this fix PHP2Shell?
You must separately confirm that the PHP patch is installed on the server. Updating the CMS does not replace updating the server environment.
My host updated PHP. Is there anything else to check?
Confirm that the handler serving your domain was updated. Then test the website. If there were signs of tampering before the update, a separate compromise assessment is needed.
Can an online scanner confirm that the website is protected?
A website address alone usually cannot reliably establish the PHP build or patch status. This requires information from the host or a server configuration check. External scans may help identify individual symptoms.
Will updating PHP remove malware?
No. It fixes the relevant vulnerability, but existing changes to files, the database or access credentials must be investigated and addressed separately.
Do you work only with WordPress and Joomla?
You can contact me about another PHP system or a custom website. I will assess what can be done and the scope after reviewing the project.
How much does a check or recovery cost?
I first need the website address, a description of the situation and hosting details. Once the task is clear, we agree on the work and price.