PHP Site AuditJoomla
Does PHP2Shell affect Joomla websites?
A Joomla update changes the CMS code; it does not install a security fix in the PHP runtime that serves requests. Check Joomla’s System Information for the web-facing PHP version, ask the host to identify the package or supported backport and restart the relevant handler, then verify Joomla administration and public pages. A public scan can observe responses, but it cannot read the server package or certify the patch.
Keep CMS and runtime updates separate
Start from the Joomla version and the domain the owner needs to protect. Joomla core, extensions and templates are maintained through the CMS, while PHP is selected and maintained by the hosting environment. Before changing the runtime, check the requirement matrix for the installed Joomla release and review extension compatibility on staging; updating Joomla alone does not change the PHP handler serving requests.
Check Joomla runtime requirements
Joomla's documentation version selector labels the current manual and older-release manuals. Choose the version installed on this site before opening its technical requirements; do not use an upcoming or unrelated version as a compatibility answer. Use that matrix to check PHP support, then separately verify whether the selected PHP package has the vendor's security fix. Compatibility with Joomla and patch status are different questions.
Read the web-facing PHP details
In Joomla administrator, open System Information and review the Server section. Joomla’s guide says this reports the PHP version used by that installation, the web server and the web-server-to-PHP interface. Record the site hostname, displayed PHP version, Joomla version, hosting account or environment, and the time checked. This is useful evidence about the web request path; it is not a package inventory and does not prove a fix was installed.
Ask the hosting operator for package proof
Ask the host or administrator: Which PHP handler serves this hostname? Which vendor package, image, or managed-runtime release contains the fix for CVE-2026-109618 and CVE-2026-109619? Is that a vendor backport? When were its request-serving workers restarted? Does this confirmation cover every production hostname and origin? Ask for an advisory or package reference instead of relying on an informal ‘we updated PHP’ message.
Close with site-specific acceptance checks
After the runtime operator confirms deployment and restart, reload System Information and compare the PHP value and handler with the ticket. Then sign in to the administrator, open representative public pages, and exercise a site-specific form or search. Review Joomla’s system information and error logs for new PHP startup errors, missing extensions, or application exceptions. If a CMS or extension update is also planned, test that separate change on staging before production.
A public request can show that a route responded after the change, but it cannot tell whether an idle worker, second virtual host, or another origin still uses an old runtime. If any hostname or pool is not accounted for, record that boundary explicitly.
If the site serves several domains or has a staging copy, include those hostnames and handlers in the request. A Joomla administrator view is useful for the specific installation it reports, but one domain or one request cannot stand in for a separate pool, origin, or region. Keep the acceptance record attached to the change ticket so the next maintenance window starts with a known runtime owner and an auditable package reference.
Common questions
Does updating Joomla patch PHP?
No. Joomla core and the PHP runtime are separate components; ask the hosting operator to confirm the serving runtime package.
Is Joomla System Information enough to prove a fix?
It can show the PHP version and interface Joomla sees, but it does not inspect package contents or verify a vendor backport.
What if Joomla shows an older-looking PHP version?
Ask the provider for its advisory and package revision. Some vendors backport security changes without adopting the upstream release number.