The PHP2Shell Emergency: What It Means for Your WordPress or Joomla Website

Most website security news is about a specific plugin, theme, or extension. PHP2Shell is different. It is a pair of critical flaws in PHP itself, the programming language that runs on the web server underneath WordPress, Joomla, and a large share of the rest of the web. That puts it below the level where most site owners, and many web teams, usually look.

If you own a WordPress or Joomla site, you may be wondering whether this affects you and what, if anything, you should do about it. This article explains what happened in plain terms, why a PHP problem is a website problem, which sites face the most risk, and the practical questions to ask your host or web team.

What Happened with PHP2Shell

In October 2026, the PHP project released emergency security updates for two vulnerabilities that security researchers nicknamed “PHP2Shell.” Here is the short version of what is known:

• Two critical flaws in PHP. Both were rated 9.2 out of 10 for severity. Under the right conditions, either one can let an attacker run their own code on a web server without logging in.
• A very wide reach. The flaws affect PHP versions going back more than a decade, and researchers estimated they touched roughly 70% of websites when they were disclosed.
• WordPress and Joomla were among the test cases. The researchers who found the flaws demonstrated attacks against WordPress, Joomla, and Drupal sites.
• The details leaked early. Information about the flaws surfaced online a day before the planned release, and the PHP team published its security advisory and fixes on October 21.
• Attacks followed quickly. On October 26, the Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its list of known exploited vulnerabilities, meaning it had evidence attackers were actively using them.

The PHP team was direct about one point: configuration changes and firewall rules can reduce exposure, but updating PHP is the only complete fix.

Why a PHP Problem Is a WordPress and Joomla Problem

PHP Is the Engine Under Your Site

WordPress and Joomla are both written in PHP. Every time someone loads a page, submits a contact form, or logs into the dashboard, PHP on the server processes that request before your content management system (CMS) does anything. A flaw at that level can expose a site even when the site itself is fully up to date and well built.

A helpful way to think about it: your CMS, theme, and plugins are the house, and PHP is the foundation. You can have new locks on every door, but a crack in the foundation is a separate problem with a separate fix.

Updating WordPress or Joomla Will Not Close This One

This is the part that catches many site owners off guard. Because PHP2Shell lives in PHP, there is no WordPress update, Joomla update, or security plugin that fixes it. The fix happens on the server, usually by your hosting provider or whoever manages your server.

• WordPress automatic updates do not change the PHP version your server runs.
• Joomla core and extension updates do not patch PHP.
• Security plugins and extensions can help detect suspicious activity, but they run on top of PHP and cannot repair it.

That does not make regular CMS updates less important. It simply means PHP2Shell is one more layer to account for.

Which Sites Face the Most Risk

Every site running PHP was potentially exposed when the flaws were announced. Once hosts began applying fixes, the picture narrowed. Sites that tend to remain at higher risk include:

• Sites on older PHP versions. The PHP project released official fixes for its supported versions, 8.2 through 8.5. PHP 8.1 and older no longer receive regular updates from the PHP project, so sites on those versions depend on their host having applied a special patch, or on moving to a newer version.
• Older Joomla sites. Joomla 3 stopped receiving official security updates in 2023. It can be kept running on older or patched PHP versions, and some independent vendors sell third-party security and compatibility patches for it, but those do not replace a fully supported CMS on a current PHP version. PHP2Shell is one more reason to plan a move. We covered the broader risks in why outdated Joomla sites get hacked.
• WordPress sites held back by old plugins or themes. Some sites stay on an old PHP version because an abandoned plugin or custom theme breaks on newer versions. That tradeoff was always a risk, and PHP2Shell makes it a more pressing one.
• Sites on servers nobody is actively managing. A self-managed server, or a forgotten hosting account, may not get patched unless someone takes action.
• Sites on shared servers. On shared hosting, many sites run on the same machine. A server-level flaw is the host’s to patch, which makes it worth knowing how quickly your host responds to issues like this.

What to Check (or Ask Your Web Team to Check)

You do not have to be technical to get clear answers here. These are the questions that matter most.

Find Out Which PHP Version Your Site Runs

• WordPress: In the dashboard, go to Tools, then Site Health, then the Info tab, and open the Server section. WordPress.org has a helpful page on checking and updating your PHP version.
• Joomla: In the administrator area, go to System, then System Information, and look for the PHP version.

One caution: some hosts apply the PHP2Shell fix without changing the version number you see. A site showing an older number may still be patched, and the only way to be sure is to ask.

Confirm Your Host Has Applied the Fix

Ask your hosting provider whether the PHP version your site uses has been patched for PHP2Shell. A reputable host should be able to answer that clearly.

Plan an Upgrade If You Are on an Unsupported Version

If your site runs PHP 8.1 or older, moving to a supported version is generally the long-term answer. A few things businesses often find helpful:

• Take a full backup of files and the database first, and keep a copy outside the hosting account.
• Update WordPress or Joomla (Joomla – if possible), plus all plugins, themes, and extensions, before changing PHP.
• Test the newer PHP version on a staging copy when one is available, checking key pages, forms, and the admin area.
• Know how to roll back if something breaks, and treat any rollback as a short-term step, not a place to stay.

Keep an eye on the calendar as well. According to the PHP project’s supported versions page, PHP 8.2 stops receiving security fixes on December 31, 2026. Sites on 8.2 that are planning a move anyway may find it efficient to go straight to a newer version.

Keep the Usual Basics in Place

PHP2Shell is unusual, but the basics still carry most of the weight in website security:

• Keep the CMS core, plugins, themes, and extensions current.
• Remove plugins and extensions you no longer use rather than just disabling them.
• Use strong, unique passwords and two-factor authentication for admin, hosting, and FTP accounts.
• Keep regular backups stored somewhere other than the web server.
• For Joomla sites, the Joomla Security Centre is a good place to watch for official announcements.

What PHP2Shell Says About Website Security Going Forward

A few broader lessons stand out from how this played out:

• The window between disclosure and attack is getting shorter. Only five days passed between the PHP fix and CISA confirming active exploitation, and researchers reported attack attempts even before the fix was released.
• Old code is getting a closer look. The flaws had been sitting in PHP for more than a decade, and researchers used AI tools to help find them. Many in the security community expect more discoveries like this in widely used software.
• Security happens in layers. The server, PHP, the CMS, and each plugin or extension all need attention. A site is only as current as its oldest layer.
• Who handles what matters. Many business owners assume their host covers everything, or that their web team does. It is worth knowing exactly who is responsible for the server, for PHP, and for the website itself.

Getting a Clear Answer for Your Site

For most business owners, PHP2Shell is less about panic and more about a few direct questions: Which PHP version is my site on, has my host patched it, and is my site ready to move to a supported version? If you are not sure of the answers, that is a reasonable place to start.

Moore Tech Solutions has worked with WordPress and Joomla sites since 2008, and we help clients sort out exactly these kinds of server and platform questions. The hosting partners behind our website hosting have confirmed they applied the PHP2Shell fixes to the PHP versions they support. If your site is on an older platform, we can also talk through WordPress redesign and update options. Feel free to contact us with questions about your site.

This article is for informational purposes only and reflects publicly reported information about PHP2Shell at the time of writing. Security conditions change quickly, and the risk to any individual website depends on its hosting environment, software versions, and configuration. It is not a guarantee of any security outcome. Contact a qualified web professional or your hosting provider for guidance specific to your website.