In short: After PHP2Shell, Matomo security is more than a question of statistics. A compromised Matomo server can inject code into every connected website via the tracker script. Patch PHP for web and archiving, restart, and then check matomo.js, config.ini.php, super users and auth tokens.
Why Matomo matters especially after PHP2Shell
Many companies, authorities and agencies use Matomo as a privacy-friendly alternative to external analytics services and host it themselves, often on their own subdomain. Matomo runs on PHP. According to the PHP team, the flaws CVE-2026-109618 and CVE-2026-109619 allow remote code execution without authentication, no matter how up to date Matomo is. What lies behind the flaws is explained in What is PHP2Shell?.
What is special about Matomo is its reach. Every tracked website loads the tracker script from the Matomo server. If matomo.js is modified, foreign code runs in the browser of all visitors of these websites, even where the website itself is clean. An agency with one central Matomo for many clients thus carries a risk for all of them.
Then there is the data: visit logs, depending on the settings truncated or full IP addresses, page views, campaign and form data from plugins. General guidance on reporting obligations can be found in the Compliance section; in the individual case, your data protection officer decides.
Matomo security: checking the PHP version and archiving
Under Administration > Diagnostics > System Check, Matomo shows the PHP version and checks requirements, including the integrity of the program files. Fixed upstream versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; distribution backports often carry older numbers.
In larger installations, Matomo generates its reports via a cron job with the command-line PHP. This version can differ from the web PHP and must be patched as well. Which PHP versions your Matomo version supports can be found in the system requirements on matomo.org.
# Output the diagnostics from the system check on the command line
./console diagnostics:run
# View the modification date of the tracker files
ls -l matomo.js piwik.js
Where malicious code sits in Matomo
| Location | Content | What to check |
|---|---|---|
matomo.js, piwik.js |
Tracker script for all websites | Content and modification date, integrity check |
config/config.ini.php |
Database credentials, salt, trusted hosts | Inserted values, renew credentials if you suspect an incident |
plugins/ |
Plugins from the Marketplace and custom ones | Unknown or modified plugins |
tmp/ |
Cache, generated assets, compiled templates | Empty after a cleanup |
misc/user/ |
Custom logos and customisations | No PHP files |
Some plugins rewrite the tracker file to integrate their own functions. That is why matomo.js is writable for the web server on many servers, which makes it attractive for attackers. If you suspect an incident, check the content carefully and compare it with the original package of your version.
If you find foreign code in the tracker script, temporarily remove the Matomo tracking code from the connected websites or block the file. Otherwise it delivers the code to further visitors every minute.
Super users, tokens and plugins
Super users in Matomo have full rights, including for plugins and system settings. Check the user list for unknown super users and enable the two-factor authentication that Matomo ships with. Auth tokens in the personal security settings allow API access without a password; renew them if you suspect an incident.
Plugins from the Marketplace extend Matomo but bring their own code. Keep only what is needed and, if possible, restrict access to the administration to known networks. On the connected websites, a Content Security Policy that allows scripts only from known sources helps; more on this under Security headers for websites.
What a Matomo update can and cannot do
A Matomo update replaces the program files and closes known flaws. It does not patch PHP, restarts neither PHP-FPM nor archiving cron jobs and removes no foreign super users, tokens or plugins. Whether code was delivered to visitors before the patch is not answered by an update; that requires logs from 20 October 2026 onward.
If Matomo is only evaluated internally, the administration can be limited to the company network while only the tracking endpoints remain public. These include the tracker script and the endpoint to which visits are reported; which files these are in your version is something you determine with your operator. This keeps the attack surface of the web interface small. Against PHP2Shell, however, this does not replace the patch, because the tracking endpoint also runs via PHP.
How does PHP SOS help?
- We check the web and CLI PHP of your Matomo server and have the patch and restart confirmed.
- We secure logs and compare
matomo.jsand the program files with the original. - We check configuration, plugins, super users and tokens and renew access credentials together with you.
- If malicious code was delivered, our emergency help coordinates the cleanup of Matomo and the connected websites.
Frequently asked questions
Why is a hacked Matomo server so dangerous?
Every tracked website loads the tracker script from the Matomo server. If this file is modified, foreign code runs in the browser of all visitors to all connected websites. A single analytics server thus becomes a distributor.
Where do I see the PHP version in Matomo?
Under Administration > Diagnostics > System Check. There Matomo shows the PHP version and checks further requirements, including file integrity. The number does not reveal a backport; your operator confirms that.
Do I need to renew the Matomo tokens if I suspect an incident?
Yes. Auth tokens allow access to the Matomo API without a password. Renew them for all users and enter the new tokens in connected systems such as dashboards or reporting tools.