PHP2Shell.fyi Check a site

PHP2Shell on Joomla

PHP2Shell is a flaw in PHP, the program Joomla runs on. When that PHP is not fixed, the Joomla site is exposed. Joomla and extension updates do not change PHP. You or your host have to update PHP itself.

Last reviewed . Rules of .

What to do

  1. Find the PHP version your site runs (see below).
  2. Pick a fixed PHP release that your Joomla version supports.
  3. Update PHP, or ask your host to do it, and make sure PHP restarts.
  4. Open System Information again and check the new version.

The researchers showed an attack without a login on Joomla using CVE-2026-109618, on the latest Joomla container image at the time.

Find your PHP version

In the administrator, go to System, then System Information in the Information panel. On the System Information tab, two rows matter:

The PHP Information tab shows the full phpinfo() page. On the server, php -v shows the command-line PHP, which can differ from the web PHP.

What the PHP interface row means

The PHP project says every PHP setup that serves web requests is at risk. The interface row tells you which kind you have:

ValueMeaning
apache2handlerApache with mod_php. The PHP project calls this the highest risk, because a shown attack runs before your app code.
fpm-fcgiPHP-FPM, usually behind nginx or Apache. Remote code execution was shown on FPM for CVE-2026-109619, through a suitable application operation.
cgi-fcgiphp-cgi over FastCGI. The PHP project lists it as at risk.
litespeedLiteSpeed. The PHP project lists it as at risk.

Whatever the row shows, the fix is the same: a fixed PHP. The interface only changes how high the risk is.

Which PHP your Joomla version supports

PHP 8.2 security support ends on 2026-12-31. See Fixed versions for all branches.

How to update PHP

On shared or managed hosting, ask your host this:

Which PHP build serves my site, and does it include the fixes
for CVE-2026-109618 and CVE-2026-109619?

When the update is in, restart every PHP process and rebuild any containers. See after you update.

What the checker can see

For Joomla, the checker looks for:

It does not use the Joomla session cookie, because its name is random.

A Joomla sign means PHP is probably in use. It does not decide the result: that comes from the PHP version the server reports. See how the checker works.

Check your site

The php2shell.fyi checker makes at most three ordinary GET requests to your site and shows every PHP signal it found. It cannot see inside your server, so your host has to confirm the result.

Sources