PHP2Shell, explained in plain language
You do not need to be technical to read this. In five minutes you know what is going on and what to do.
Based on the confirmed facts from our status page last checked
In one sentence
A serious security holeA vulnerability is a weakness in software that an attacker can use to do something the software was never meant to allow, such as reading private data. was found in PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it., the software behind many websites. A fix is available: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Have it installed as soon as possible.
What is PHP?
PHP is the engine behind many websites. WordPressWordPress is free software for building and editing a website in your browser. It is written in PHP, so it builds each page when someone visits. and most web shops run on it, for example. You do not see it as a visitor: it runs on the server of your hosting providerWeb hosting is the service that keeps your website's files on a computer that is always online, so visitors can open your site at any time., out of sight.
Think of it like the engine of a car. You drive the car (your website), but the engine is under the hood.
What went wrong?
Two holes were found in that engine. Through them, an outsider can run commands on the server where your website lives, without logging in.
In practice that can mean: someone takes over your website, changes it, or looks at data that is stored on it.
Does this affect my website?
If your website runs on PHP and has not been updated yet: very likely. Older PHP versions (8.1 and older) no longer get updates at all.
Not sure what your website runs on? Use the check below, or ask your hosting provider or the person who built your website.
- Domain
- Check
- Result
- Report
We are checking
We only read what your site already sends in public. This takes a few seconds.
- Looking up the domain
- Connecting to your site
- Reading the headers
- Identifying the platform
- Identifying the CDN or firewall
Adds platform, firewall or CDN, hosting and your previous scan. We add your result to the form. A person replies within 1 business day.
Details
- Website
- PHP
- PHP version
- Checked
Headers we looked at
What this does not tell you
Read how to find your PHP version yourself
Ask your hosting provider
Copy this question and send it to your hosting provider or developer. You do not need to give us an email address for this.
Which PHP version does this website use, and how do I check that in my hosting panel?
Where should we send your report?
You see the report below. The email version, ready to forward to your web developer, follows.
Your full report
- Website
- PHP
- PHP version
- Platform
- Firewall/CDN
- Hosting
- Previous scan
We add your result to the form. A person replies within 1 business day.
What should I do?
- Ask your hosting provider or web developer to update PHP to a fixed version (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35).
- Make sure a recent backupA backup is a separate copy of your website's files and database, so you can bring the site back after a mistake, a hack or a failed update. of your website exists before the update.
- Does your website run on PHP 8.1 or older? Then a regular update is not enough. Ask about an upgrade to a supported version.
- Do you not have anyone to do this? We can do it for you. Use the form on this page.
Want to hand it off? Have your PHP updated to a supported version. Want to know where you stand first? Check which PHP version you run.
Is it being abused already?
Not confirmed by php.net or CISA (KEV). Cloudflare reports attack traffic, watchTowr (via The Register) sees exploitation attempts and CERT-EU reports circulating proof-of-concept code; none of these sources confirms successful exploitation.
See also which rumours are true and which are not.
Words you may come across
- Security hole (vulnerability)
- A mistake in software that someone can misuse to get in.
- Update (patch)
- A new version of the software in which the mistake has been fixed.
- Hosting provider
- The company where your website is stored and runs.
- CVE number
- An official ID for a security hole, so everyone knows which one is meant.
Want the details?
The status page lists every fact with its source and the time we checked it, plus a live timeline.