In short: What should you do as a hosting customer about the PHP vulnerability PHP2Shell? You usually do not have to install the PHP update yourself; with shared hosting, the hosting provider does that. Your tasks are different: obtain a written confirmation of the patch level, choose a supported PHP version in the customer menu and check your website for anomalies. This article answers the 15 most common questions on this briefly and in order.
PHP vulnerability as a hosting customer: am I affected, what should I do?
Since 21 October 2026, we have received many questions from companies whose website is with a hosting provider. Most revolve around the same points. Anyone who would like to read about the responsibilities in more detail will find them under Shared hosting: what the host does and what you have to do.
1. Is my website affected at all?
If your website runs on WordPress, Shopware, TYPO3, Joomla, Contao or another PHP system, the server underneath may be affected. Pure HTML pages without PHP are not. If in doubt, a look at the customer menu helps: if there is a setting for the PHP version, you use PHP.
2. What is the difference between shared hosting and your own server?
With shared hosting, you share a server operated by the hosting provider with other customers; the hosting provider maintains PHP. With your own root server or vServer, you are responsible yourself. With a managed server, the contract governs who installs updates.
3. My hosting provider sent a circular email. Do I still need to do anything?
Read carefully what it says. A circular email often only confirms that the hosting provider is "working on the matter". You need a statement about your package: PHP branch, patch level, time and restart.
Responsibility and update
4. Does the hosting provider install the update automatically?
As a rule, yes, for the PHP versions it offers on its servers. Whether that has already happened and whether older versions are covered as well differs from one hosting provider to another. Ask.
5. My customer menu shows an old version number. Am I unprotected?
Not necessarily. Many hosting providers build fixes in as a backport, and the number then stays the same. Plesk, for example, can continue to display 8.2.34 even though the flaw has been fixed. The hosting provider's confirmation is what counts.
6. I still use PHP 7.4 or 8.1. What now?
The PHP project no longer ships official updates for these branches. Some hosting providers supply their own fixes, others do not. Clarify this in writing and plan the move to a supported branch. Beforehand, check in your CMS's system requirements which PHP versions it supports.
7. Can I change the PHP version myself?
With most hosting providers, yes, in the customer menu. How this works and what to watch for beforehand is described in the article Changing the PHP version in the hosting customer area. Make a backup first.
8. Does it help to update WordPress or plugins?
Not against PHP2Shell, because the vulnerability is in PHP. CMS updates are worthwhile anyway, because they close other vulnerabilities.
Checking and proving
9. How do I get proof from the hosting provider?
With a written request that asks for specific details: package status per PHP branch, date of installation, restart of all PHP processes. A template to copy is offered by the guide Requesting hosting provider PHP update confirmation.
10. Can I set interim measures via .user.ini?
No. php.net expressly advises against setting the interim settings via ini_set() or .user.ini. They belong in the server configuration, and with shared hosting the hosting provider manages that.
11. My website was offline briefly. Was I hacked?
Not necessarily. Some hosting providers took websites offline as a precaution or restarted servers. Ask for the reason before drawing conclusions.
12. How do I recognise that my website was attacked?
Possible signs are unknown administrator accounts, new PHP files in the upload folder, redirects to other sites, foreign pages in the Google index or warnings in Search Console. Ask the hosting provider to keep access logs from 20 October onward.
When something is not right
13. The hosting provider does not reply or replies evasively. What should I do?
Ask in writing and set a reasonable deadline. If no answer comes, you should treat the server as unchecked and consider switching the website temporarily to a static emergency page.
14. Should I change hosting provider?
A switch in the middle of the situation creates its own risks. It makes sense if the hosting provider permanently gives no information or keeps running old PHP versions without a fix. What to bear in mind is described in Changing hosting provider after an incident.
15. Do I have to report anything?
If there are signs of an attack and personal data may be affected, a reporting obligation under the GDPR may exist, generally within 72 hours. Clarify this with your data protection officer or a lawyer. This is not legal advice.
Your quick checklist
- Ask the hosting provider in writing about the patch level and restart.
- Check the PHP version in the customer menu, replace outdated branches.
- Review administrator accounts and the upload folder.
- Check Search Console for warnings.
- If anything looks unusual, get help before you delete files.
How does PHP SOS help?
- Clarification with the hosting provider: We draft the request or hold the conversation and assess the reply.
- Checking the website: We look for traces in files, database and accounts, as far as the hosting package allows.
- Cleanup: If we find malicious code, we remove it and change all access credentials.
- Documentation: You receive the status in writing.
If you have a specific suspicion, the emergency help for hacked websites can help.
Conclusion
As a hosting customer, you do not bear the burden of the update with PHP2Shell, but you do bear responsibility for your website. Most questions can be settled with a clear written answer from your hosting provider. What remains afterwards is a look at your own website: accounts, files, Google notices. Anyone who has done both has done their part and can, if in doubt, show that they acted carefully.
Frequently asked questions
Who is responsible for the PHP update in web hosting?
With shared hosting, generally the hosting provider, because it operates the server and the PHP installation. You are responsible for your website, your access credentials and the choice of PHP version in the customer menu. With managed servers, the contract governs the split.
Why does my hosting provider show an old PHP version?
Many hosting providers and distributions build the fix into the existing version as a backport. The number then stays the same even though the vulnerability is closed. Rely on a written confirmation from the hosting provider, not on the display.
What can I check myself as a hosting customer?
You can check the PHP version set in the customer menu, review the administrator accounts of your CMS, look for unknown files in the upload folder and check Search Console for warnings. Only the hosting provider can prove the patch level of the server itself.
Does a firewall setting in the hosting package help?
Firewall rules from the hosting provider or an upstream service can reduce the risk. But they do not replace the PHP update on the server. Always ask about the update first.