Joomla · PHP2Shell

Is my Joomla site affected by PHP2Shell?

Probably, unless your PHP is already patched. Joomla was one of three public demo targets, but the bug is in PHP — your Joomla version and extensions do not change the answer.

Last reviewed 2026-10-22

Updating Joomla does not fix this

PHP2Shell is in PHP itself, below Joomla. Researchers demonstrated unauthenticated remote code execution against the official joomla:latest image. What matters is the PHP version your server runs, and only whoever manages the server can update it.

1. Find your PHP version in Joomla

This shows the PHP that actually serves your site, which is the one that matters.

  1. Log in to the Administrator panel.
  2. Open System → System Information.
  3. On the System Information tab, read PHP Version.
command line (shows the CLI PHP — may differ from the web server)
php -v
php cli/joomla.php --version   # Joomla 4/5 console (shows the Joomla version)

2. Compare it

Paste a version, the output of php -v, or one version per line for a whole fleet. Runs entirely in your browser.

Try:

The CLI and the web server can run different PHP builds. Check the version your web server actually uses: php-fpm -v (or php-fpm8.3 -v), or phpinfo() served by that site.

BranchVulnerableFixed in
8.5< 8.5.128.5.12
8.4< 8.4.278.4.27
8.3< 8.3.368.3.36
8.2< 8.2.358.2.35
8.1 · 8.0 · 7.4allSource backport only
5.4 – 7.3allNo fix

3. Get it patched

Shared or managed hosting

Your host patches PHP. Choose the newest PHP version in your hosting panel, then ask them to confirm the patch and the restart. Hosting guide →

Your own server, VPS or container

You (or your developer) patch PHP and restart PHP-FPM / Apache. Patch guide →

email to your host
Subject: PHP2Shell (CVE-2026-109618 / CVE-2026-109619) — patch status

Hi,

Please confirm that the PHP runtime serving my site(s) <domain> has been
updated to a release that fixes CVE-2026-109618 and CVE-2026-109619
(PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or a vendor build with the backport),
and that PHP-FPM / LSAPI workers were restarted afterwards.

If my account is on PHP 8.1 or older, please tell me which patched version
I can move to.

Thanks

Managed Joomla hosting

Most Joomla sites run on shared hosting with cPanel, Plesk or DirectAdmin. Switch to the newest PHP version in the panel and ask the host to confirm the patched build. We have not verified individual hosts’ status.

4. After patching

  • Check the PHP version in Joomla again — it should show a fixed release (or ask your host to confirm a backported build).
  • If the site was exposed for a while, change admin passwords and API keys stored in the site configuration, and look for unknown admin users or new PHP files. Detection guide →

Questions

Is my Joomla site affected by PHP2Shell?+

If it runs on PHP older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (and the host has not installed a patched package), yes. The Joomla version, theme and extensions do not matter — the bug is in PHP.

Will updating Joomla fix PHP2Shell?+

No. Joomla updates change the application, not the PHP runtime underneath. Keep Joomla updated anyway, but the fix is a PHP update by whoever runs your server.

Does an attacker need an admin account?+

No. The demonstrated attacks are pre-authentication: no login, no special plugin or module, just HTTP requests to the site.

Does a Joomla security extension protect me?+

No. Extensions run inside Joomla, after PHP has already parsed the request — the vulnerable code runs before that. A WAF in front of the site helps; the PHP update fixes it.

I am still on Joomla 3. What now?+

Joomla 3 sites often run on PHP 7.4 or 8.0, which get no new PHP release. Ask your host for a backported build as a stopgap and plan the move to Joomla 5 on PHP 8.4 or 8.5.

Related