Is my website affected by PHP2Shell? How to check in 15 minutes

Whether your website is affected by PHP2Shell is determined by the PHP version on the server, not by the CMS. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are safe, as are packages from your Linux distribution to which the fix has been backported. You can find the version in just a few minutes in the hosting customer area, in the WordPress menu “Site Health” or with the command php -v.

Background information on the vulnerability is available in the article PHP2Shell: What companies need to know now. The only question here is: Am I affected, and what do I need to do?

Step 1: Is your website running on PHP at all?

WordPress, TYPO3, Joomla, Drupal, Contao, Shopware, Magento and many site builders with traditional hosting providers use PHP. Websites built with pure site-builder systems from major platforms or modern JavaScript frameworks often do not. If in doubt, ask your web designer or hosting provider.

Step 2: Find out the PHP version

In the hosting customer area

At most hosting providers, you will find the PHP version under “PHP settings”, “PHP version”, or in the webspace settings. Note the full version number, for example 8.3.36 and not just 8.3.

In WordPress

Under “Tools → Site Health → Info → Server”, WordPress displays the PHP version. Here too, the full number matters.

On your own servers

Use the command php -v on the command line. Note: the web server version may differ from the command-line version. If in doubt, check the version used by the web server. On Linux distributions such as Debian or Ubuntu, the version number alone says little, because fixes are often backported to older packages. The security advisory from your distribution is what matters.

Step 3: Assess the version

Step 4: Ask your hosting provider or service provider

Send a short email: “Is PHP on our web space or server patched against CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)? Please include the version number.” A written response also helps with documentation, for example in relation to data protection officers.

Step 5: Don’t forget devices

Firewalls, routers, VPN gateways and network-attached storage (NAS) devices often have a web interface with PHP. The BSI names products from OPNsense, pfSense, QNAP and Synology, among others, as at least partially affected. Check whether the manufacturer provides a firmware update, and install it. Web interfaces on such devices should generally not be accessible from the internet.

Step 6: Look for traces

Were there any anomalies between the 17th and the day you updated? New PHP files, unknown users, sudden errors? What to do next is explained in Website hacked? Recognize the signs and respond correctly.

Unsure whether your website, online shop, or devices are affected? Get in touch with us. We check your systems, install updates, and tell you honestly what needs to be done – even if it turns out that everything is fine. To get started, a brief conversation.

Frequently Asked Questions

How do I find my PHP version?

In the hosting customer area under the PHP settings, in WordPress under Tools → Site Health → Info → Server, or on your own servers with the command php -v.

My website was built with a website builder. Do I need to do anything?

For major website builder platforms, the provider takes care of the servers. If in doubt, ask them. If you also operate your own devices with a web interface, check those separately.

My server uses PHP 8.1. What now?

PHP 8.1 no longer receives regular updates. Backport patches are available for PHP2Shell, but in the long term you should switch to a supported version. More on this in the article about outdated PHP versions.

As of: 24 October 2026. Source: BSI security advisory on PHP2Shell.