Picked
PHP2Shell: older websites can be taken over
- Why it matters
- Two critical PHP flaws let attackers take over a website without logging in, and they're being used right now.
- What we're doing
- We're tracking this for every client and will contact you directly if a website you own is affected.
- What you should do
- If you have a WordPress, Joomla or custom PHP website, ask your web host to confirm it runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later.
What's going on
PHP is the programming language that quietly runs most WordPress and Joomla websites and many custom ones. Two critical flaws in older PHP versions let an attacker take over a website without logging in, and they're being used in real attacks. Your website's own software can be fully up to date and still be exposed, because PHP is maintained by whoever hosts the site. The fix is a PHP update on the hosting side, so this is a question for your web host or developer rather than something you change on your own computer.
How to check
- Find out who hosts your website and who maintains it (often a web host, a developer or an agency).
- Ask them: “Which PHP version is our website running?”
- If you manage your own hosting account, many control panels show it under a setting named something like PHP Version or MultiPHP Manager.
- Compare the answer with the fixed versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35, or later in the same series. Versions older than 8.2 aren't on the fixed list.
What to do if your site isn't on a fixed version
- Ask your web host or developer to update PHP to a fixed version and confirm it in writing.
- If the site runs on an older PHP that can't be updated, ask whether it should be taken offline until it's rebuilt or moved.
- Ask them to check for signs of a past break-in, such as admin accounts or files nobody recognizes, because these flaws are being used in real attacks.
- If you have more than one website, ask the same questions for each one.
Deeper dive: check from the command line
Optional, for readers comfortable with a command line. These commands only read information; they don't change, install or delete anything. Run them only on computers and websites you own or are responsible for. Results depend on how a computer is set up, so a clean result isn't a guarantee. If something looks wrong, or you're not sure what you're seeing, stop and call your IT provider. Provided as-is, for information.
Mac or Linux (Terminal): does your website announce its PHP version
curl -sI https://www.yourwebsite.com | grep -i "x-powered-by"What you should see: Replace www.yourwebsite.com with your own site first. If the site shows it, you'll see something like "X-Powered-By: PHP/8.3.36". Many hosts hide this line, so no output doesn't mean you're safe: ask your host.
Windows (PowerShell): does your website announce its PHP version
curl.exe -sI https://www.yourwebsite.com | findstr /i "x-powered-by"What you should see: Replace www.yourwebsite.com with your own site first. A result like "X-Powered-By: PHP/8.3.36" shows the version. No output is common and doesn't mean you're safe: ask your host.
If you have SSH access to your hosting account: the PHP version on the server
php -vWhat you should see: The first line shows the version, such as "PHP 8.3.36". The website can be set to use a different PHP than this command, so your hosting panel's PHP Version setting is the one that counts.