Has Your PHP Website Been Hacked Your business website suddenly redirects visitors to an unfamiliar page. Customers report security warnings. Strange administrator accounts appear, or your hosting provider contacts you about suspicious files.
These problems can be signs that someone has gained unauthorised access to your website.
For businesses that depend on their websites for enquiries, ecommerce orders or customer communication, a compromise can quickly become an operational problem.
So, how can you tell whether your PHP website has been hacked?
Common warning signs include unexpected redirects, unfamiliar PHP files, modified website content, unknown administrator accounts, suspicious server activity and browser security warnings. However, no single symptom proves that a website has been compromised. A proper investigation is needed to establish what happened.
PHP powers many web applications, including WordPress-based websites, custom business platforms and ecommerce systems. A security weakness in any part of the environment, from the PHP runtime to a plugin or stolen administrator credentials, can create exposure.
This guide explains nine warning signs, the immediate actions to take and a practical recovery process for UK businesses and website administrators.
What Does It Mean When a PHP Website Is Hacked?
A hacked PHP website is a website where an unauthorised person has gained access to, modified or misused the application, its data, accounts or supporting infrastructure.
Attackers may exploit vulnerable software, steal credentials, abuse insecure file uploads or take advantage of incorrectly configured servers.
Possible consequences include:
- Injecting malicious code into website files.
- Redirecting visitors to fraudulent websites.
- Creating hidden administrator accounts.
- Stealing or exposing sensitive information.
- Sending spam through the server.
- Installing backdoors that allow future access.
- Disrupting the website or changing its content.
A compromised website does not always display obvious symptoms. Some attackers attempt to remain undetected, particularly when their objective is to collect information or maintain persistent access.
That makes monitoring, logging and routine security reviews important even when the website appears to be working normally.
Important: What About the Reported October 2026 PHP Vulnerabilities?
Reports circulated in October 2026 describing serious alleged vulnerabilities in PHP, sometimes referred to as “php2shell”, and associating them with CVE identifiers CVE-2026-109618 and CVE-2026-109619.
These reports require careful verification before being treated as established technical facts.
A widely shared claim, a media report and an official vulnerability advisory are not equivalent sources of evidence.
Website administrators should confirm the affected PHP versions, exploit conditions and available fixes through official PHP security releases, recognised vulnerability records and their hosting provider.
A reported PHP vulnerability does not mean every PHP website has been hacked. Vulnerability exposure, attempted exploitation and confirmed compromise are three different things.
For current information, consult:
- Official PHP releases and security updates
- PHP supported versions
- NIST National Vulnerability Database
- UK National Cyber Security Centre
If an official advisory identifies a vulnerability affecting your deployment, follow the vendor’s instructions promptly. If compromise is suspected, updating the software alone may not remove an attacker’s existing access.
1. Your Website Redirects Visitors to Suspicious Pages
Unexpected redirects are among the most noticeable warning signs of a compromised website.
A visitor may open your homepage but end up on a gambling site, fake shopping page or unfamiliar domain.
In some cases, redirects occur only on mobile devices, for visitors arriving from search engines or for users who are not logged in.
This selective behaviour can make the problem difficult for administrators to reproduce.
Why Malicious Redirects Happen
Attackers may modify PHP files, website configuration, database content or third-party scripts to change where visitors are sent.
For WordPress websites, compromised plugins, themes or database entries can also be involved.
How to Investigate
Check whether the redirect occurs across different browsers and devices.
Review recent file changes and server logs.
Inspect authorised redirect rules, application settings and relevant database content.
Avoid repeatedly visiting suspicious destinations from an ordinary work device.
Important: Not every unexpected redirect is malicious. Incorrect domain settings, caching issues and legitimate redirect rules can produce similar symptoms.
2. Unknown PHP Files or Suspicious Code Appear
A compromised website may contain files that the owner or developer does not recognise.
Attackers sometimes upload PHP scripts designed to provide remote access, execute commands or restore access after other malicious files have been removed.
These are commonly called web shells or backdoors.
Suspicious files may appear in upload directories, temporary folders, plugin directories or other writable locations.
What Should You Look For?
Unexpected PHP files, recently modified application code and unexplained changes to server configuration deserve investigation.
Developers may also encounter heavily obfuscated code, unfamiliar external connections or unexpected execution functions.
However, obfuscation and unusual-looking code are not definitive evidence of malware. Some legitimate commercial applications use code protection or generated files.
How to Respond
Compare website files against trusted versions from your source repository or official software packages.
Preserve suspicious files for investigation before removing them.
Avoid deleting unfamiliar files at random because they may be legitimate application components or useful evidence.
Where a compromise is confirmed, rebuilding the application from verified clean sources is often safer than attempting to identify and delete every malicious line manually.
3. Your Website Displays Unauthorised Content
A hacked website may suddenly display content that the business never published.
This could include spam links, fake product pages, unfamiliar articles, altered contact details or misleading payment instructions.
Sometimes the changes are visible only to search engines or particular visitors.
Why This Matters
Attackers may use compromised websites to distribute scams, manipulate search results or redirect potential customers.
For an ecommerce business, unauthorised changes to payment or contact information can create immediate financial and reputational risks.
How to Check
Review recent content changes, user activity and administrator accounts.
Compare important pages against known-good copies.
Inspect database changes and content management system logs where available.
If customers may have been exposed to fraudulent information, assess whether communication or other protective action is needed.
4. New Administrator Accounts Appear Without Permission
An unknown administrator account is a serious warning sign.
Attackers who gain sufficient access may create new accounts so they can return later, even after the original vulnerability has been fixed.
They may also modify the permissions of existing users.
What to Investigate
Review administrator accounts and privileged roles.
Check account creation dates, login history and recent permission changes.
Verify unfamiliar accounts with the people responsible for website management.
How to Respond
If unauthorised access is confirmed, revoke suspicious sessions and credentials as part of a coordinated response.
Review the authentication methods used by all privileged users.
Enable MFA wherever supported.
Do not assume that deleting an unknown account fully resolves the incident. Attackers may have created additional access methods elsewhere in the environment.
5. Your Hosting Provider Reports Suspicious Activity
Hosting providers may detect unusual behaviour such as malware files, unexpected processes, excessive outbound email or abnormal resource consumption.
They may suspend affected services to limit harm.
A hosting alert should be taken seriously, particularly if it identifies a specific file, process or security event.
What Should You Do?
Contact the provider through its official support channel.
Request the relevant alert details, timestamps and available logs.
Determine whether the suspicious activity relates to your application, hosting account or another component.
Ask what evidence can be preserved before files or services are reset.
A hosting suspension does not automatically prove a successful attack, but it is a reason to investigate promptly.
6. Your Website Becomes Unexpectedly Slow or Unstable
A compromised server may consume additional resources while running unauthorised processes.
Visitors might experience slow page loads, repeated errors or intermittent outages.
However, poor performance can also result from traffic spikes, database problems, inadequate hosting resources or faulty application updates.
How to Investigate
Review server CPU and memory usage, application errors, scheduled tasks and recent deployment changes.
Look for unexplained processes or unusual outbound connections.
Compare performance patterns with traffic and application activity.
If the server appears compromised, involve qualified technical support before making disruptive changes that could destroy evidence.
Slow performance alone is not proof of hacking. It becomes more concerning when accompanied by suspicious files, unauthorised logins or unexplained network activity.
7. Browsers or Search Engines Show Security Warnings
Visitors may encounter browser warnings stating that a website could be dangerous.
Search engines may also identify malware, deceptive pages or other security issues.
These warnings can reduce customer confidence and discourage visitors from continuing.
How to Check
Review the website’s status in Google Search Console, particularly the Security Issues section.
You can also consult Google Safe Browsing’s site status checker.
What to Do
Investigate the reported issue and confirm whether malicious content or compromised resources are present.
After remediation, follow the relevant review process.
Do not request a security review before the underlying problem has been resolved.
Also distinguish malware warnings from certificate errors. An expired TLS certificate can trigger a browser warning without indicating that the website was hacked.
8. Your Website Sends Spam or Makes Unusual Connections
A compromised website may be misused to send unwanted email, contact external servers or perform unauthorised automated tasks.
A business might first notice the problem when email delivery fails, a hosting provider reports abuse or server logs show unfamiliar outbound activity.
What to Investigate
Review mail logs, scheduled jobs, application tasks and outbound network connections.
Check whether the website has legitimate functions that explain the activity.
For example, an ecommerce platform may legitimately send order notifications or communicate with payment and shipping services.
Unexpected activity should be evaluated against the application’s normal behaviour.
How to Respond
Contain unauthorised processes and investigate their origin.
Review exposed credentials and application integrations.
If email accounts or sending services were affected, coordinate remediation with the relevant providers.
Simply stopping a suspicious process may not remove the access that allowed it to start.
9. Customer Data or Website Records Change Unexpectedly
Unexplained changes to customer records, orders, account details or database entries can indicate unauthorised activity.
This is especially concerning for websites that process personal information or handle ecommerce transactions.
Examples of Suspicious Changes
A customer’s email address may be altered without their request.
Order records may contain unexplained modifications.
Administrative settings or payment-related configuration may change unexpectedly.
How to Investigate
Review database audit records, application logs and account activity where available.
Compare relevant records against trusted backups or independent transaction records.
Assess whether personal data has been accessed, altered, disclosed or lost.
For businesses processing customer information, this may also create data protection obligations.
Not every database inconsistency results from an attack. Software bugs, integration failures and administrative mistakes can produce similar effects.
The priority is establishing the cause and protecting affected information.
Critical October 2026 Update: PHP2Shell Is Confirmed
Updated: 23 October 2026
Official security advisories now confirm two critical vulnerabilities in the PHP core runtime, collectively known as PHP2Shell:
- CVE-2026-109618: Memory corruption associated with out-of-memory handling.
- CVE-2026-109619: Unsafe reuse of internal state referencing previously freed memory.
Both can potentially allow unauthenticated remote code execution under affected conditions. Emergency PHP updates were released on 21 October 2026. This is a confirmed runtime security issue, not merely an unverified online report.
NHS England Digital
+2
The earlier article section advising verification of the reports should therefore be replaced with this confirmed update before publication.
Which PHP Versions Need Updating?
| PHP branch | Fixed version |
|---|---|
| PHP 8.5 | 8.5.12 or later |
| PHP 8.4 | 8.4.27 or later |
| PHP 8.3 | 8.3.36 or later |
| PHP 8.2 | 8.2.35 or later |
| PHP 8.1 and older | Upgrade to a supported release or obtain a verified vendor-supported backport |
These fixed versions are documented by NHS England, Ubuntu and the PHP ecosystem’s security advisories. Linux distributions may backport security fixes without changing the upstream version number, so check the installed package against the relevant vendor advisory rather than relying on the version string alone.
NHS England Digital
+2
Immediate action for website owners: Ask your hosting provider to confirm which PHP runtime serves your website, whether the PHP2Shell fixes have been applied and whether the running service has loaded the patched build. Updating WordPress plugins or themes alone does not resolve vulnerabilities in the underlying PHP runtime.
Patching is essential, but it does not automatically remove an existing compromise. Administrators should also investigate suspicious activity during the period their systems were exposed.
Information Security at University of Toronto
+1
How to Fix a Hacked PHP Website: A Safe Recovery Process
If you believe your PHP website has been compromised, avoid immediately deleting suspicious files or restoring a backup without investigating.
Those actions may destroy useful evidence or reintroduce the same weakness.
Step 1: Contain the Incident
Restrict public access or isolate affected systems where appropriate, especially if customer information or payment functionality may be at risk.
Coordinate with your hosting provider or incident response specialist to minimise further damage while preserving evidence.
Step 2: Preserve Logs and Evidence
Retain available web server logs, PHP error logs, authentication records, application logs and suspicious files.
Record when unusual activity was first observed and what changes have already been made.
Preserving evidence helps establish the cause and assess whether information was accessed or altered.
Step 3: Identify the Entry Point
Investigate potential causes such as an unpatched PHP runtime, vulnerable application components, stolen credentials, insecure file uploads or compromised hosting access.
For PHP2Shell specifically, examine relevant server and PHP logs for unusual request patterns, memory errors, unexpected child processes and signs of persistence. These indicators are useful for investigation but are not proof of exploitation on their own.
Information Security at University of Toronto
Step 4: Rebuild From Trusted Sources
Where compromise is confirmed, restoring a verified clean application and environment is generally safer than removing a few suspicious files and assuming the problem is solved.
Check that backups predate the compromise and are themselves clean.
Preserve legitimate business data carefully so malicious content or unauthorised changes are not reintroduced.
Step 5: Patch the PHP Runtime and Application
Apply the appropriate PHP security update, then update the CMS, plugins, themes, dependencies and server packages.
For PHP2Shell, confirm the patched runtime is actually running.
Test application compatibility in an appropriate environment and prioritise the security update.
Step 6: Rotate Credentials and Remove Persistence
Change potentially compromised passwords, API keys, database credentials and other secrets.
Revoke suspicious sessions and review administrator accounts, scheduled jobs, deployment keys and file permissions.
A successful attacker may have established more than one method of access.
Step 7: Validate and Monitor
Confirm that malicious behaviour has stopped and that the underlying vulnerability has been addressed.
Test essential website functionality, customer journeys and payment integrations.
Monitor logs and account activity for signs of renewed compromise.
If Google Search Console reports a security issue, request a review only after completing remediation.
Step 8: Assess Notification Requirements
Determine whether customer or employee personal data was affected.
For UK businesses, assess relevant UK GDPR obligations, including whether the incident must be reported to the ICO.
Where required, the reporting deadline is generally 72 hours after becoming aware of a personal data breach, where feasible.
Use the ICO’s official personal data breach guidance.
PHP Security Best Practices to Prevent Future Attacks
Once the website is secure, establish a maintenance process that reduces the likelihood of another incident.
Prioritise supported PHP releases, prompt security updates, restricted administrator access, MFA, secure backups, server monitoring and regular reviews of plugins and dependencies.
For custom PHP applications, use established security practices such as parameterised database queries, appropriate output encoding, secure session handling, careful file upload validation and least-privilege database permissions.
A web application firewall may help reduce exposure to some attacks, but it should not be treated as a substitute for patching PHP2Shell.
AWS Security Blog
Website security is strongest when the runtime, application code, hosting environment and access management are maintained together.
10. FAQ Section
How do I know if my PHP website has been hacked?
Check for unexpected redirects, unfamiliar files, unknown administrator accounts, unauthorised content changes, hosting security alerts and suspicious server activity. These are warning signs, not definitive proof. Confirm a compromise through logs, file comparisons and technical investigation.
Can PHP itself be vulnerable to hacking?
Yes. Security flaws can exist in the PHP runtime as well as in PHP-based applications. The October 2026 PHP2Shell vulnerabilities demonstrate why keeping the underlying PHP version updated is important.
What is PHP2Shell?
PHP2Shell is the name given to two critical PHP runtime vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They involve unsafe memory handling and can potentially enable remote code execution. Official patches were released on 21 October 2026.
NHS England Digital
Does PHP2Shell mean every WordPress website has been hacked?
No. An affected runtime may be vulnerable without having been successfully compromised. WordPress website owners should confirm their hosting environment has received the PHP security fixes and investigate suspicious activity where appropriate.
Will updating PHP remove malware?
No. Updating PHP closes vulnerabilities addressed by that release, but it does not necessarily remove malicious files, unauthorised accounts or stolen credentials. Confirmed compromises require a broader recovery process.
Can I recover a hacked PHP website using a backup?
A verified clean backup can be an important part of recovery. However, restoring an old backup without fixing the original vulnerability may lead to reinfection. Investigate the cause and secure the environment before returning the website to service.
How can I secure my PHP website?
Keep PHP and application dependencies updated, enable MFA, limit administrator permissions, maintain tested backups, monitor logs and review website security regularly. Use supported software and reputable hosting arrangements.
Should I take my PHP website offline?
If a critical vulnerability cannot be patched immediately, temporarily restricting or disabling an exposed service may be appropriate based on a risk assessment. For PHP2Shell, NHS England’s advisory specifically recommends considering taking vulnerable systems offline until they can be patched.
Concerned About Your PHP Website’s Security or Maintenance?
An outdated website can expose your business to avoidable technical and security risks.
At CRAZILS, we provide professional Web Design & Development, Ecommerce Solutions, and Website Maintenance & Support services for UK businesses and international clients.
Whether you need help reviewing your website’s maintenance requirements, updating an existing website or planning a more reliable digital platform, we can discuss practical next steps.
For an active or suspected security breach, seek qualified incident response support promptly.
Contact CRAZILS to discuss your website requirements.
Website: https://crazils.com
Email: info@crazils.com
Phone / WhatsApp: +44 7897 053081
CRAZILS – Digital Solutions. Real Growth.
