Short answer
Sites built on WordPress, WooCommerce, Drupal, Joomla, Magento, Laravel run on PHP, so they're affected by PHP2Shell until their PHP is a fixed release (8.2.35, 8.3.36, 8.4.27, 8.5.12). Sites on Shopify, Webflow, Squarespace, Wix don't run PHP you manage, so there's nothing for you to patch there.
| Platform | Runs PHP you manage? | Who updates PHP |
|---|---|---|
| WordPress | Yes | Your host or developer |
| WooCommerce | Yes | Your host or developer |
| Drupal | Yes | Your host or developer |
| Joomla | Yes | Your host or developer |
| Magento (Adobe Commerce) | Yes | Your host or developer |
| Laravel | Yes | Your host or developer |
| Shopify | No | Shopify runs the servers |
| Webflow | No | Webflow runs the servers |
| Squarespace | No | Squarespace runs the servers |
| Wix | No | Wix runs the servers |
PHP Scanner recognizes more than 50 platforms and hosts from what a page shows. Does my website use PHP? explains how to tell yourself.
Sources
Checked against these sources on October 22, 2026. PHP Scanner is a free tool from Catch Digital and is not affiliated with the PHP project.