PHP2Shell and Joomla: is your Joomla site affected?

Is my Joomla site affected by PHP2Shell?

Your Joomla site is affected if the PHP it runs on is below the fixed release for its branch, or is PHP 8.1 or older without a vendor patch. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of flaws in PHP itself, so every Joomla site on an unpatched PHP is in scope, whatever its version, template or extensions.

Joomla has been tested specifically. Wiz reports that it demonstrated unauthenticated remote code execution on Joomla deployments, as well as on WordPress and Drupal.

Does updating Joomla fix PHP2Shell?

No. Joomla core and extension updates don’t change the PHP your server runs. Keep Joomla updated, but the PHP2Shell fix comes only from updating PHP to a fixed release or your vendor’s patched package.

We found no official Joomla statement about PHP2Shell as of 22 Oct 2026. Neither the Joomla Security Centre nor the Joomla announcements page mentions it. The most recent Joomla security release (6.1.4 and 5.4.9) fixed Joomla’s own bugs, and Joomla 6.2 and 5.4.10 (13 October) were feature and bugfix releases. None of these touches PHP.

How do I find the PHP version Joomla runs on?

You can check from the administrator panel:

1. Sign in to the Joomla administrator.
2. Open System, then System Information in the Information panel.
3. On the System Information tab, note the PHP Version. This is the PHP serving your site.

A php -v on the server shows the command-line PHP, which can differ from the PHP that serves pages. Use System Information for the website. Then enter the version in the PHP2Shell checker. More methods: check PHP version.

Which PHP version should my Joomla site move to?

Move to the fixed release on a PHP branch your Joomla version supports. Joomla’s technical requirements list:

The 5.x page gives only a minimum and a recommended version, so the table stops at the recommended 8.3. Neither page lists PHP 8.5, so we can’t confirm that 8.5.12 works with Joomla; test any newer branch on a copy first. For Joomla 5 on PHP 8.1, there is no new release from PHP: use a vendor-patched package (for example, Ubuntu shipped a fixed php8.1 for 22.04) or move to PHP 8.2 or 8.3. Note that Joomla 5.4.10 was the last 5.x bugfix release; 5.4 now gets security fixes only, for one more year.

Who updates PHP for my Joomla site?

It depends on how the site is hosted.

After the update, restart PHP and reload System Information to confirm the new version.

How do I tell if my Joomla site was already compromised?

Updating PHP stops new attacks but says nothing about the past. In Joomla, check:

• Users: Super Users you don’t recognise (Users → Manage, filter by group).
• Extensions: anything in System → Manage → Extensions you didn’t install.
• Media folders: .php files in images or media, which should hold only assets.
• Configuration: unexpected changes to configuration.php or .htaccess.

If you find something, follow the full compromise checklist before cleaning up, then change all passwords and the secret in configuration.php.

Does a WAF or a PHP setting protect Joomla until I patch?

Neither is a fix. Cloudflare says its WAF blocks known attack patterns, but it also saw attackers altering their requests to get past it. Joomla security extensions run on top of PHP, and PHP has confirmed at least one attack path that runs before any application code. PHP’s official stopgaps only block specific paths; see the CVE-2026-109618 workaround for their limits. Use the PHP2Shell patch guide to get PHP updated.