# Joomla Vulnerability PHP2Shell: Securing Joomla Websites > Secure Joomla after PHP2Shell: check the PHP version in the system information, protect configuration.php, review Super Users and extensions. Source: https://phpsos.de/en/plattformen/joomla/ As of: 25/10/2026 Provider: PHP SOS, PHP emergency help and server security. Immediate help via WhatsApp: https://wa.me/491736494914?text=Hello%20PHP%20SOS%2C%20we%20need%20help%20with%20our%20PHP%20server.%20Company%3A%20%E2%80%A6%20Website%3A%20%E2%80%A6 **In short:** The Joomla vulnerability currently being discussed is called PHP2Shell and sits in the server's PHP, not in Joomla. A Joomla update does not close it. After the PHP patch and restart, you should check `configuration.php`, template overrides, extensions and the list of Super Users. ## What PHP2Shell means for Joomla Joomla is a PHP CMS and inherits every weakness of the PHP underneath. According to the PHP team, the flaws CVE-2026-109618 and CVE-2026-109619 allow code execution without authentication. The usual operating modes are affected: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Smaller Joomla websites of clubs, tradespeople or associations in particular often run on shared hosting and are rarely maintained. There, the PHP update is up to the host. Your task is to ask for the status and check the website for traces. Which versions are affected is shown in [Which PHP versions are affected?](https://phpsos.de/en/php2shell/betroffene-php-versionen/). ## Joomla vulnerability: checking the PHP version In the administrator area, **System > System Information** shows the PHP version and the most important PHP settings. This is the version Joomla is actually running on for the web. Fixed upstream versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If Joomla shows an older number, a backport may still have been applied; your host has to confirm that. On shared hosting, the PHP version can often be switched per domain in the host's customer menu. This only switches between the versions the host provides; whether these are patched is up to the host. A switch to a newer major version can still make sense if your Joomla version and all extensions support it. Test this beforehand, because older extensions often break with error messages on newer PHP versions. Joomla itself states minimum PHP requirements for each major version. Which PHP versions your Joomla version supports can be found in the system requirements on joomla.org. With very old Joomla releases, a PHP switch may first require a Joomla upgrade. ## Typical hiding places for malicious code in Joomla | Location | Content | What to look for | |---|---|---| | `configuration.php` | Database credentials, `$secret`, paths for logs and temp | Modification date, inserted code | | `images/`, `media/` | Images and media | PHP files are suspicious | | `tmp/` | Temporary files, including from installations | Leftovers of foreign packages | | `templates//html/` | Template overrides with PHP code | Unknown or modified overrides | | `plugins/system/` | System plugins that load on every request | Unknown plugins | | `administrator/logs/` | Logs | Secure before making changes | | `.htaccess` | Redirects, rewrite rules | Redirects only for search engines | System plugins are especially popular because they run on every page request. You should always be able to explain an unknown plugin in this folder. Harmless checks on the command line (Joomla 4 and later ships with its own console): ```bash # PHP files in media and temp folders find images media tmp -type f -name "*.php" # List users and extensions php cli/joomla.php user:list php cli/joomla.php extension:list ``` > **Important:** > If your Joomla website redirects visitors from Google to foreign sites, or Google shows a warning, the server is very likely already compromised. An update is then not enough; a cleanup is needed, followed by a review in the Search Console. ## Administrator access and extensions The administrator area is located at `/administrator`. Check the user group "Super Users" for unknown accounts and for accounts of former service providers. Enable the two-factor authentication that Joomla ships with, and use personal rather than shared accounts. Extensions from the Joomla Extensions Directory and from third parties are numerous on many websites: forms, galleries, page builders, newsletters. Each brings its own PHP code and often its own upload functions. Extensions whose vendor no longer delivers updates are a permanent risk and make every PHP upgrade harder. Uninstall anything unused completely. ## What a Joomla update can and cannot do A Joomla update replaces the core files and closes known flaws in Joomla. It does not patch PHP, does not touch template overrides and third-party extensions and does not remove files that are not part of the core. Database entries such as new Super Users also remain. If your website has already been altered, the procedure under [Website hacked? Remote emergency help](https://phpsos.de/en/leistungen/website-gehackt-notfallhilfe/) helps. For the search for backdoors, the guide [Detecting and removing webshells](https://phpsos.de/en/ratgeber/webshell-erkennen/) is worthwhile. If your Joomla website was set up by an agency or freelancer, ask them which extensions and templates were customised. Customised files cannot simply be compared with the original package and need an individual review. ## How does PHP SOS help? - We ask your host for the PHP status or check it on your server, including the restart. - We secure logs, files and database before any change. - We compare the core with the original package and check overrides, system plugins, media folders and Super Users. - If we find something, we clean up the website, renew access credentials and support the removal of Google warnings. ## Frequently asked questions **Is Joomla affected by PHP2Shell?** Joomla itself has no new flaw, but it runs on PHP. If the server's PHP is not patched, an attacker can, according to the PHP team, execute code without authentication. A Joomla update changes nothing about that. **Where do I find the PHP version in Joomla?** In the administrator area under System > System Information. You will also see the PHP settings there. The number does not tell you whether a backport has been applied; your host has to confirm that. **Why are template overrides a risk?** Overrides sit in the template folder and contain PHP code that replaces the output of components and modules. Injected code hardly stands out there, because overrides are not replaced during Joomla updates. ## Sources - [php.net: Security announcements](https://www.php.net/) - [Joomla](https://www.joomla.org/) - [OWASP Cheat Sheets](https://cheatsheetseries.owasp.org/) - [Google Search Console Help](https://support.google.com/webmasters/)