Can visiting a hacked website hack you? What PHP2Shell means for visitors

MacWindowsiPhoneAndroidUpdated

PHP2Shell is a flaw in the software that runs on a website's server, not on your phone or computer. Visiting a PHP site doesn't expose your device to the flaw itself. The risk to visitors comes later, if attackers take over a site and change what it shows you.

Quick answer

The PHP vulnerabilities disclosed on 21 October 2026 affect PHP installations serving web requests, which means web servers. A visit doesn't run PHP on your device. But Google says hacked sites can redirect visitors to harmful pages, host phishing pages or try to install malicious software. Keep your browser updated, avoid unexpected downloads and check addresses before signing in.

What does a PHP flaw on a website mean for visitors?

The flaw sits on the site's server. The PHP manual explains that PHP code is executed on the server, which generates HTML and sends it to your browser. Your browser receives the result and never sees the PHP code. The PHP advisory for CVE-2026-109618 and CVE-2026-109619 says the people at risk are PHP installations serving web requests, and the NCSC says the issue may allow attackers to execute commands on any web server running PHP.

The NCSC's advice is aimed at organisations running PHP: find it and update it. For a visitor, PHP2Shell matters if a site you use gets taken over, because then what the site shows you can change.

What could a hacked website do to visitors?

Google's guidance for site owners describes what attackers do once they have access to a site:

  • Change existing pages. Google says hackers may inject malicious code into existing pages.
  • Send you somewhere else. Google says injected code can redirect some users to harmful or spammy pages.
  • Add new pages. Google says hackers can add pages with spammy or malicious content, and that these are often used to attempt phishing.
  • Try to install software. Google says hacked content can potentially install malicious content on users' machines, and shows an example of a deceptive popup intended to trick someone into installing malware.
  • Ask for your password. Google says phishing sites may look exactly like the real site, and that hackers can take control of innocent sites to host this kind of content.

Several of these only work if you do something, such as accepting a download or typing a password into a fake page. Those are the moments the steps below are about.

Will my browser warn me about a dangerous site?

It may. Google Safe Browsing shows warnings when people try to go to dangerous sites or download dangerous files. Each major browser has its own warnings:

  • Safari on Mac. Choose Safari > Settings, then click Security. Apple says "Warn when visiting a fraudulent website" gives you a warning if a site is a suspected phishing website.
  • Chrome. Google says Chrome shows a red "Dangerous site" warning for phishing, malware, unwanted software or social engineering sites, and advises against visiting. On a computer, the protection level is under More > Settings > Privacy and security > Security, under Safe Browsing.
  • Microsoft Edge. Microsoft says SmartScreen checks sites against a list of reported phishing and malicious software sites, and checks downloads against programs known to be unsafe. It blocks matches and tells you the site or download has been blocked for your safety.

These lists rely on sites being reported. Microsoft's own help page has a "Report unsafe website" option for a site that wasn't flagged, so treat no warning as no warning, not as proof a site is safe.

How do I protect myself when visiting websites?

A few habits cover most of the risks Google describes.

  1. Keep your browser and device updated. The NCSC says applying security updates promptly helps protect your devices and accounts, and that you should turn on automatic updates in your device's settings if available.
  2. Don't download things you didn't go looking for. Apple says some downloads may not contain the software they claim to, and advises getting apps from the App Store or directly from the developer's website. On a Mac, Apple warns that software that isn't signed and notarised may expose your computer and personal information to malware.
  3. Check the address before you type a password. Apple's phishing guidance warns about links that look right where the URL doesn't match the company's website. On a Mac, hover over a link to see where it goes; on an iPhone or iPad, press and hold it. If in doubt, the NCSC says to contact the organisation directly through its official website.
  4. Use a password manager. The NCSC says a password manager lets you have unique passwords for each service, and that it helps protect you from phishing because the password will only autofill on the correct website.
  5. Turn on 2-step verification. The NCSC says it helps keep criminals out of your accounts even if they know your passwords.

What if I already typed a password or downloaded something?

Act on the specific thing. For passwords, the NCSC says to change the passwords on any accounts that use the same password, and that you could use a passkey instead where one is available. For a download, it says to run a full scan with your antivirus software if you have it and let it clean up what it finds.

If you lost money, the NCSC says to tell your bank and report it as a crime to Report Fraud in England, Wales and Northern Ireland, or Police Scotland in Scotland. You can also report a suspicious website to the NCSC. Its reporting page asks you not to click links or enter personal information on the site.

Where Failshot fits

Failshot is second layer device security for your Mac, for a different moment: someone using your Mac in person. Your password is the first layer, and Failshot is the layer after it. While it's on, it photographs whoever unlocks your Mac, then, with Pro, records a 5-second video, and its window tells them the unlock was photographed. Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.

The Mac app is a free download for macOS 14 or later, and free to use. Pro adds video, email alerts and the encrypted vault. Try Failshot Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel. iPhone, Android and Windows versions are coming soon.

More questions

Is it safe to visit a website affected by the PHP vulnerability?

The flaw is on the website's server, and the PHP manual says PHP runs on the server, not in your browser. The concern for visitors is a site that has been taken over. Be wary of unexpected downloads, redirects and login prompts there.

Can I tell if a website uses PHP?

Not reliably. The PHP manual says a web server can be configured to process all its pages with PHP, and then there is no way for users to tell PHP is being used.

Would a website owner know their site was hacked?

Not always. Google says that when a site is hacked, it's not uncommon for the hacker to use cloaking to make the hack harder for the site owner to detect. So caution with downloads and passwords applies on familiar sites too.

Has PHP2Shell been used against websites?

As of 23 October 2026, the US agency CISA says in its alert of 21 October, revised on 23 October, that it "has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication", and that they still pose a risk if left unpatched. The PHP project says a fixed release is the only complete solution, so check the advisories for updates.

Does this affect my phone?

Not directly. PHP2Shell affects PHP installations serving web requests, which are servers, not phones. A hacked site could still show a fake login page or prompt a download on any device, so the same habits apply: update, check addresses and use 2-step verification.

Sources