In short: A large share of the widespread content management systems (CMS) and shop systems is written in PHP, including WordPress with WooCommerce, TYPO3, Joomla, Drupal, Contao, Shopware, Magento or Adobe Commerce, and PrestaShop. Add to that internal applications such as Nextcloud, Moodle, MediaWiki and Matomo. Anyone operating one of these systems is affected by flaws in the PHP interpreter such as PHP2Shell, no matter how current the CMS itself is.
Why so many websites run on PHP
Since the 1990s PHP has been tailored to web servers and is available at practically every web hosting provider. A PHP-based CMS can therefore be operated without its own server infrastructure, which was and is attractive especially for small and medium-sized businesses, associations and public authorities.
For operators this means: the website is not just "WordPress" or "Shopware" but a stack of several layers. At the bottom runs the operating system, above it the web server, then the PHP interpreter and at the very top the CMS with extensions. Each layer needs its own updates. A flaw in PHP hits all systems built on it.
Then there are extensions: plugins, themes, modules and shop interfaces are also PHP code, often from small vendors. They run with the same privileges as the CMS and are executed by the same PHP runtime. A CMS with many extensions therefore has a larger attack surface than a lean installation, even if the core is current.
We leave out figures on the prevalence of individual systems here. There is no source for them that we consider reliable and comparable.
Widespread PHP-based CMS and shop systems
The table names well-known systems and what the vendors themselves say about their technical basis. We deliberately do not state version requirements because they change with every release.
| System | Type | Note on the technical basis |
|---|---|---|
| WordPress, WooCommerce | CMS, shop extension | PHP application, MySQL or MariaDB according to the requirements |
| TYPO3 | CMS | according to the docs, needs a web server, PHP and an SQL database |
| Joomla | CMS | PHP with MySQL, MariaDB or PostgreSQL |
| Drupal | CMS | PHP; core extensions listed in core/composer.json |
| Contao | CMS | according to the vendor, based on the Symfony full-stack framework |
| Craft CMS | CMS | vendor names Yii among the tools used |
| Shopware 6 | Shop | developer docs treat plugins as Symfony bundles |
| Magento Open Source, Adobe Commerce | Shop | PHP and Composer in the system requirements |
| PrestaShop | Shop | PHP with its own compatibility table |
| Nextcloud | File storage | Apache with mod_php or PHP-FPM, Nginx with PHP-FPM |
| Moodle | Learning platform | developed in PHP according to the docs |
| MediaWiki, Matomo | Wiki, statistics | PHP according to the installation requirements |
Many of these systems internally use building blocks from PHP frameworks and load libraries via Composer. For most of them we have dedicated pages with notes on securing them, for example WordPress, Shopware 6 and TYPO3.
How do I find out whether my website runs on PHP?
Many companies do not know exactly which systems are running in their organisation, especially if an agency built the website. These steps bring clarity:
- Create an inventory: List all domains, subdomains and internal web interfaces, including test systems and old campaign sites.
- Ask the hosting provider or agency: Which system, which PHP version, which operating mode (PHP-FPM, mod_php, LiteSpeed)? Ask for a written answer.
- Look at the hosting panel: In Plesk, cPanel and similar interfaces, the PHP version is shown per website. Note that distribution backports do not change the displayed number.
- Check on the server: Admins can tell from the processes and the web server configuration which PHP runtime is actually serving.
- Do not forget devices: NAS systems, routers and appliances often have a web interface that may also run on PHP.
# On the server: which PHP processes are running?
ps -eo user,cmd | grep -E 'php-fpm|lsphp|php-cgi|frankenphp' | grep -v grep
Taking system requirements seriously
Every vendor publishes which PHP versions its software has been tested with. This information is the basis for any update planning: a PHP update to a version the CMS does not yet support can bring the website down. A CMS that runs only on a PHP version without security updates is a permanent risk.
Therefore check, according to the vendor's system requirements for your exact version, which PHP versions come into question, and compare that with the fixed PHP versions. For systems that run only on PHP 8.1 or older, there are no more official updates from the PHP project.
What PHP2Shell means for CMS and shop operators
PHP2Shell consists of the flaws CVE-2026-109618 and CVE-2026-109619 in the PHP interpreter, both with CVSS 9.2. They allow the execution of malicious code without authentication. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. A CMS update does not close these flaws; why is explained in our article Why a WordPress update does not help against PHP2Shell.
For shops this weighs especially heavily, because customer data, orders and credentials for payment and shipping services are stored there. A patch also does not remove malware that was injected beforehand and does not prove that nothing happened.
How does PHP SOS help?
- We create an inventory of your PHP-based websites and internal applications with system, PHP version and operating mode.
- We compare vendor requirements with the fixed PHP versions and plan the update per system.
- We install the PHP updates, restart all processes and then check whether the CMS and shop run correctly.
- If an incident is suspected, we examine the system as part of the PHP2Shell immediate help.
Frequently asked questions
Does WordPress run on PHP?
Yes. WordPress is a PHP application and, according to the official requirements, needs PHP and a MySQL or MariaDB database. Flaws in the PHP interpreter therefore affect every WordPress installation, regardless of the state of WordPress itself.
Does a CMS update help against PHP2Shell?
No. The flaw lies in PHP, not in the CMS. According to drweb.de, WordPress.org therefore does not plan its own update against it either. It is closed only by a fixed PHP version and the restart of all PHP processes.
How do I find out which PHP version my shop needs?
From the vendor's system requirements for your specific version. These details change with every major release, so you should read them directly from the vendor and not take them from older guides.
Are internal applications affected too?
Yes, if they run on PHP. File storage such as Nextcloud, learning platforms such as Moodle, internal wikis with MediaWiki or Matomo for statistics are PHP applications. They are often forgotten in inventories.
Is a website without .php in the address not PHP?
Not necessarily. Modern systems route all addresses through a central index.php, so .php never appears in the URL. The only certain way is to look at the server or to ask the hosting provider or agency.