How to Check If a PHP Website Was Hacked After PHP2Shell

PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two critical PHP request-handling vulnerabilities disclosed on October 21, 2026. Because the reported attack paths can involve unauthenticated remote code execution, website owners should treat unusual server activity as an incident signal while checking whether systems were exposed.

Check	What to look for	What it means
PHP version	8.2.35, 8.3.36, 8.4.27 or 8.5.12	These are the fixed upstream releases
Server logs	Unusual multipart requests, fatal errors or out-of-memory events	Potential exploitation indicators, not proof
File integrity	Unknown scripts, changed configuration or new accounts	Possible post-compromise activity

Start with evidence and patch verification

Before cleaning files or restarting services, preserve relevant web-server, PHP-FPM, system and authentication logs. Record timestamps, affected hosts, deployed PHP versions and recent administrative actions. Review requests around suspicious multipart uploads, PHP warnings, use-after-free or fatal-error messages, repeated worker crashes, and unexpected command execution. The absence of a matching log entry does not prove that exploitation did not occur.

Confirm the running PHP version rather than relying on a package name or control-panel display. PHP 8.1 and older no longer receive upstream updates, although some operating-system vendors may provide backported fixes. If the site is managed through a CMS, also verify extensions, upload directories and deployment changes. This is where a documented website development and maintenance review can help organize the technical audit, but it should not replace incident-response expertise when compromise is suspected.

Inspect the website and host for follow-on activity

Compare application files and configuration with trusted backups or version-controlled copies. Search for recently created scripts, administrator accounts, scheduled tasks, unfamiliar processes, outbound connections and authentication events. If evidence suggests access, isolate the affected host where practical, rotate application, database, hosting and SSH credentials, and investigate connected systems before restoring service.

Review access, persistence and outbound activity

Once the initial evidence is preserved, examine the host for changes that could support continued access. Compare document-root files, PHP libraries, upload directories and server configuration with a trusted deployment or clean backup. Pay particular attention to recently modified files, short or obfuscated scripts, unexpected extensions, altered rewrite rules and configuration values that enable remote connections or command execution.

Review operating-system and application accounts for newly created users, changed privileges, unfamiliar API keys and unexpected administrator sessions. Check scheduled tasks, service definitions, startup files and running processes for persistence. Network telemetry can add useful context: investigate unfamiliar outbound destinations, unusual data transfers and connections that began near suspicious requests or PHP worker failures. These findings are indicators for investigation, not standalone proof of PHP2Shell exploitation.

• Export web-server, PHP-FPM, system and authentication logs before retention rules remove them.
• Record file hashes, modification times, process details and relevant network destinations.
• Compare production code and configuration against a known-good source or deployment artifact.
• Review database changes, CMS administrator activity and upload records for the same time window.

Contain suspected compromise carefully

If several signals align, restrict external access or isolate the affected host while preserving evidence. Rotate database, hosting-panel, deployment, SSH, API and application credentials from a separate trusted device. Invalidate active sessions and review connected services, staging systems and backups for unauthorized changes. Do not simply delete an unfamiliar file and return the site to production; that can destroy useful evidence and leave another access path undiscovered.

For a complex deployment, a structured technical consultation can help coordinate the review across application, infrastructure and recovery work. It should complement, not replace, qualified incident-response support when remote code execution or credential theft is plausible.

Validate the repair before bringing the site back online

After containment, treat recovery as a verification exercise rather than a quick file replacement. Rebuild the application from a known-good source whenever possible, then apply the fixed PHP release and current operating-system security updates. If a clean rebuild is not practical, document every file and configuration change, preserve suspicious copies for analysis, and have a qualified reviewer inspect them before deletion.

Test the repaired site in an isolated environment first. Confirm that PHP-FPM, the web server, database connections, upload handling and scheduled jobs behave as expected without restoring untrusted plugins, themes or application packages. Review permissions so the web process cannot modify more files than necessary, and disable unused upload, debugging and administrative functions. These controls reduce exposure but do not establish that the earlier incident was harmless.

Use a recovery checklist

• Verify the running PHP binary and package version on every web-facing host, including replicas and staging systems.
• Revoke exposed sessions, tokens, API keys and deployment credentials, then issue replacements from a trusted device.
• Restore databases and media only from backups whose creation and integrity can be explained.
• Monitor requests, process launches, file changes and outbound traffic closely after re-enabling public access.
• Record the timeline, indicators, decisions and remaining uncertainties for future response work.

Businesses that need help coordinating application, infrastructure and recovery checks can use a technical project consultation as an organisational starting point. The most important conclusion is that checking whether a PHP website was hacked after PHP2Shell requires several forms of evidence: patch status, logs, file integrity, account activity and host behaviour. A single quiet log or clean-looking homepage is not enough. Continue monitoring after remediation, because delayed discovery of persistence or stolen credentials can make an apparently successful repair incomplete.

Interpret PHP2Shell indicators in context

Log evidence can help establish a timeline, but it rarely proves exploitation by itself. Correlate web-server access records with PHP-FPM, system and security logs to identify requests that preceded worker crashes, memory exhaustion, fatal errors or unexpected process activity. Review multipart and session-upload traffic, unusual request sizes, repeated failures and requests sent to endpoints that normally receive little traffic. Preserve the original files and timestamps before filtering or rotating them.

Look for sequences rather than isolated warnings: a suspicious request followed by a PHP service restart, a new file, an account change or an outbound connection deserves closer examination. Also check load balancers, reverse proxies, container logs and centralized monitoring, because the application host may not contain the complete request history. The absence of a matching entry does not establish that the server was safe, particularly when logs were incomplete, overwritten or handled by another layer.

Confirm the PHP repair across the environment

Verify the installed and running PHP versions directly on every internet-facing host. Check both the command-line binary and the PHP runtime used by the web server or PHP-FPM, since they can reference different installations. Confirm that the deployed release is one of the patched versions identified in the official advisory, or that a trusted operating-system vendor has supplied a documented backport. Repeat the check on replicas, staging systems and failover nodes before considering the exposure closed.

After patching, inspect deployment records and configuration management for unauthorized changes. Reconcile enabled modules, pool settings, upload directories and administrative interfaces with the approved baseline. A technical project consultation may help teams organise these application and infrastructure checks when ownership is spread across developers, hosting providers and operations staff.

Continue monitoring after remediation

Keep heightened monitoring in place after service restoration. Alert on renewed PHP worker failures, unexpected file changes, new privileged sessions, unusual outbound traffic and access-token use from unfamiliar locations. Document unresolved questions and preserve relevant evidence so later findings can be compared against the original incident timeline.

Investigate the wider environment after PHP2Shell

Checking the website itself is only one part of determining whether PHP2Shell was exploited. Review the host for newly created PHP scripts, altered configuration files, unexpected administrators, unfamiliar scheduled tasks and processes that do not match the approved application stack. Pay particular attention to upload directories, temporary locations and web-accessible folders where an attacker might try to place executable code.

Examine outbound connections from the web server and PHP-FPM processes, including requests to unfamiliar addresses, mail activity and transfers to external services. Compare these findings with deployment records and normal application behaviour. A suspicious connection or new file is an investigative lead, not proof of compromise, but several related changes occurring after an unusual request should be escalated quickly.

Check credentials and connected systems

Assume that credentials may be exposed if unauthorized code execution or data access cannot be ruled out. Review authentication logs for hosting panels, SSH, databases, cloud services, deployment platforms and administrator accounts. Look for new keys, password resets, privilege changes, token use from unfamiliar locations and sessions that continued after the suspected incident window.

• Rotate passwords, API keys, session secrets and deployment credentials from a trusted device.
• Revoke active sessions and tokens before issuing replacements.
• Inspect databases, object storage, backups and connected internal services for unusual access.
• Ask hosting or security providers whether they retain proxy, firewall or platform-level logs.

Preserve evidence before cleaning the server. Export relevant logs, record file hashes and timestamps, photograph important console findings, and keep suspicious files in a controlled location for qualified analysis. Avoid repeatedly restarting services or deleting indicators before the timeline is documented.

If the investigation spans application code, hosting configuration and business systems, a technical project consultation can help coordinate the review. Continue monitoring after remediation, because delayed signs of persistence or stolen credentials may appear even after the PHP runtime has been patched.

What to do when the evidence remains unclear

Not every PHP warning, memory spike or unfamiliar file means PHP2Shell was exploited. However, uncertainty should lead to a documented investigation rather than an assumption of safety. Compare the affected host with a trusted backup or clean deployment, review changes made during the exposure window, and ask an incident-response specialist to examine suspicious code, processes and network activity when internal expertise is limited.

If compromise is confirmed, rebuild from a known-good source when practical instead of relying only on file deletion. Restore application code and configuration from verified copies, apply the supported PHP update, close unnecessary administrative access, and validate permissions before reconnecting the server. Treat databases, backups, API integrations and user sessions as potentially affected until their access history has been reviewed.

Final checklist for checking a PHP website after PHP2Shell

• Confirm the web-facing runtime uses PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or a documented vendor backport.
• Preserve web-server, PHP-FPM, system, authentication and proxy logs before they rotate.
• Investigate unusual multipart requests, session-upload activity, fatal errors, out-of-memory events and worker crashes as a timeline.
• Compare application files, configuration, modules, permissions and scheduled tasks with trusted baselines.
• Review new accounts, credentials, tokens, outbound connections and activity in connected systems.
• Rotate secrets and revoke sessions if unauthorized access cannot be excluded.

The safest answer to “how to check if a PHP website was hacked after PHP2Shell” is therefore a combination of patch verification, evidence preservation and broader forensic review. A clean-looking website or missing log entry is not conclusive proof that no attacker reached the server.