What to do about PHP2Shell

Was I hacked?

Security companies reported attack attempts from 17 October 2026, four days before the fix was released. If your site ran an unpatched PHP in that window and wasn't behind a firewall service, it's worth checking. Patch first, then look.

Signs on a website

• New administrator accounts you didn't create.
• PHP files where there shouldn't be any. In WordPress, wp-content/uploads should hold images and documents, never .php files.
• Files changed recently that nobody on your side touched.
• Redirects to other sites, spam pages, or unfamiliar links, especially when visiting from Google.
• Warnings from Google Search Console, your browser, or your host.
• Your host telling you the account is sending spam or using unusual resources.

Signs on a server

If you have SSH access, these are quick checks. Change paths and the web user (www-data, apache, nginx or the site's own user) to match your setup.

# PHP files changed since 15 October
find /var/www -name '*.php' -newermt '2026-10-15' -ls

# PHP files in WordPress upload folders (there should be none)
find /var/www -path '*wp-content/uploads*' -name '*.php'

# Scheduled tasks for root and the web user
crontab -l; crontab -l -u www-data; ls -la /etc/cron.*

# Processes running as the web user, and their network connections
ps -u www-data -f
ss -tunp | grep -i php

In your web and PHP logs, look for PHP workers crashing or running out of memory, alongside unusually large form uploads (multipart POST requests) to pages that don't normally take uploads. Security researchers have also flagged requests with odd session parameters and very large PHPSESSID values.

If you find something

1. Don't just delete the file. Attackers usually leave more than one way back in.
2. Take the site offline so PHP isn't running (here's how; a maintenance-mode plugin isn't enough), and keep copies of the logs.
3. Patch PHP first, or the same hole is still open.
4. Restore from a clean backup taken before the attack, if you have one, then apply updates.
5. Change every password and key the server could see: hosting, database, SSH, FTP, WordPress admins, API keys and payment-provider keys. In WordPress, also reset the security keys in wp-config.php.
6. Report it. If personal data may have been exposed, data protection law may require you to notify your regulator. Under GDPR, that's usually within 72 hours: the ICO in the UK, the Data Protection Commission in Ireland, or your national authority elsewhere in the EU. You can also report incidents to your national cyber security agency, such as CISA in the US or the NCSC in the UK.

Cleaning up a compromised server properly is specialist work. If you're not sure, get help.