Joomla runs on PHP, so a Joomla site is affected by PHP2Shell if its server runs PHP older than the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12). Updating Joomla itself doesn't fix it; your host or developer updates PHP. For Joomla 5.4, the Joomla manual recommends PHP 8.3, with PHP 8.1 as the minimum.
- Joomla runs on PHP
- Yes
- newest fixed release
- 8.5.12
Is Joomla affected by PHP2Shell?
Joomla is written in PHP, and each Joomla release lists the PHP versions it supports. PHP2Shell is a flaw in PHP itself, not in Joomla, so updating Joomla or its plugins doesn't fix it. A Joomla site is affected if its server runs PHP from before the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12), released October 21, 2026.
How to see your PHP version in Joomla
- Log in to the Joomla administrator.
- Open System, then System Information.
- The PHP Version line shows the version.
Who updates PHP for a Joomla site
Your host on shared hosting, your developer on your own server.
Guides for common hosts: cPanel, Plesk, Hostinger.
Which PHP version Joomla supports
For Joomla 5.4, the Joomla manual recommends PHP 8.3, with PHP 8.1 as the minimum. Whatever the line, use its newest release: for PHP2Shell that means 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later.
What PHP Scanner looks for on a Joomla site
PHP Scanner recognizes Joomla from a page generator tag naming Joomla, Joomla script folders such as /media/jui/ or /media/system/js/. Many Joomla servers hide their PHP version, which is good practice; then your result asks you to paste the version from the steps above for an exact rating.
Questions people ask
Is my Joomla site safe from PHP2Shell?
No outside check can promise that. What you can confirm is that its PHP is a fixed release (8.2.35, 8.3.36, 8.4.27, 8.5.12) or newer. If it is, PHP2Shell's fix is in.
Does updating Joomla fix PHP2Shell?
No. PHP2Shell is in PHP, which your host or developer updates. Keep Joomla updated as well, but it's a separate job.
What PHP version should Joomla run?
For Joomla 5.4, the Joomla manual recommends PHP 8.3, with PHP 8.1 as the minimum. Use the newest release of whichever line you're on.
My host says PHP is up to date but the version looks old. Why?
Some hosts and Linux distributions add security fixes without changing the version number. Ask your host to confirm in writing that the PHP2Shell fix is applied.
Sources
Checked against these sources on October 22, 2026. PHP Scanner is a free tool from Catch Digital and is not affiliated with the PHP project.