Joomla and the PHP2Shell Flaws: Patching Steps for Joomla 3, 4 and 5

By Umair Ali Sadaqat · Updated · Editorial policy

Joomla sites are exposed to Black October through PHP, not through Joomla. The catch: many Joomla 3 sites are stuck on old PHP. How to patch, and what to do if your site cannot move to a newer PHP branch.

Joomla runs on PHP, so the two critical PHP flaws fixed on 21 October 2026 reach every Joomla site whose server has not been updated. Nothing inside Joomla's own code is the problem, and no Joomla extension update replaces patching PHP. The Black October overview explains the bugs; this page is about getting a Joomla site onto a safe version.

Find your PHP version in Joomla

In the administrator area open System → System Information (in Joomla 3 it lives under System → System Information as well, from the top menu). The "PHP Version" line shows the PHP that runs your site. You need 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or a newer release in those lines, or a distribution build that includes the backported fix.

The Joomla 3 problem

Joomla 3 reached end of life in 2023, and a lot of Joomla 3 sites still run because their templates and extensions were never ported. Those sites tend to sit on PHP 7.4 or 8.0, and there is no official PHP release with the fix for those branches.

That leaves three realistic paths:

  1. Use a distribution or vendor that backports. Some Linux distributions and long-term support vendors ship patched builds of older PHP. If your host uses one, ask them to confirm it in writing.
  2. Build from the PHP team's backport branches. The advisory links minimal source backports for PHP 7.4, 8.0 and 8.1. This is only realistic if you run your own server and are comfortable compiling PHP. Details are in the old PHP versions guide.
  3. Migrate. Upgrade to Joomla 5 on a supported PHP, or rebuild the site somewhere else. This is the only path that does not leave you exposed to the next PHP bug too.

Patching Joomla 4 and 5

Joomla 4 and 5 run on PHP 8 branches that do have fixed releases, so this is usually simple:

  1. Back up with your usual tool (Akeeba Backup is the common choice) and store the copy off the server.
  2. Update PHP within the branch you are on: through your host's panel, or with your server's package manager.
  3. Restart PHP-FPM or Apache so the old build is no longer in memory.
  4. Reload System Information and confirm the new version.
  5. Check the front end, a contact form, and logging in as a user.

If you are moving branches at the same time (say 8.1 to 8.3), first check that every extension you use states support for the target version, and do the move on a copy of the site before touching the live one.

Joomla settings that do not help

Joomla's Global Configuration lets you change error reporting and session handling. Neither is a mitigation for PHP2Shell. The PHP team says hiding errors does not help, and the session-related workaround has to be set in php.ini or the server configuration before PHP reads the request, not in Joomla. If you need the temporary measures, use the stopgap guide.

Where to look for a break-in on Joomla

  • Users → Manage: any Super User account you did not create.
  • /images, /media and /tmp: PHP files in these folders are a red flag.
  • configuration.php: check its modification time and look for unfamiliar code at the top or bottom.
  • System → Manage → Extensions: anything installed recently that you do not remember.

Our compromise checklist has the full process.

Move your site to WeInc

If your Joomla 3 site is stuck because of an old template, rebuilding may cost less than keeping it alive. Move your site to WeInc: first month free with code BLACKOCTOBER, until November 21, 2026. New customers only. Claim the offer

More in Blog

Related guides and tools

Start building

How we research, test and update this page: our editorial policy. We.Inc is our own product.

Product

Who It's For

Features

Resources

Company

View Sitemap