What if someone got in before the patch? Three signs
Worried someone got in before PHP2Shell was patched? Save your logs first, look for three signs, check files and admin users, and know who to ask for what.
By Jeensuk Yang
PHPFree · Web security · Risk series 04
?Who this is for
- PHP is patched, but you worry someone got in before that
- You don't know what to check, or in what order
- You want a clear list of what to ask your developer or host
!What you'll learn
- The three signs the researchers who found PHP2Shell say to look for
- A five-step check, from saving your logs to changing passwords
- On shared hosting, who checks what
"Nothing looks different, so we're probably fine." Are you sure?
"Nothing looks different" is exactly what an intruder wants. If nobody notices, they can keep using the back door for a long time. Psychologists call our habit of assuming things will stay normal normalcy bias.1 Separate from the patch, here's the order for checking whether anyone got in, and who to ask for what.
Where do you start checking for a break-in?
By not deleting anything. Server logs work like security camera footage: they record when, where from and what each request was. But restarting or rebuilding a server can wipe them. TechTarget's advice is to preserve all server logs from October 20 onward before restarting or rebuilding anything.2
- Save the logs (before any restart; from Oct 20 on)
- Look for the three signs (from the researchers who found the bugs)
- Check files and users (PHP files you don't know, admins you don't know)
- Change passwords and keys (always if anything looks off)
- If something's wrong, isolate the server, keep the evidence, and get help
The whole check on one page, so it's easy to share with your team.
Preserve all server logs from Oct. 20 onward before restarting or rebuilding servers. — TechTarget, Oct 21, 2026
Jeensuk's takeThe first step isn't finding anything. It's making sure nothing gets erased.
No errors on the site. Doesn't that mean we're fine?
Not necessarily. As of October 25, 2026, no confirmed indicators of compromise had been published for this vulnerability, so finding an attack means looking for unusual behavior.2
Jeensuk's take"No error messages, so we're fine" doesn't work this time. You have to look for the signs below directly.
What are the three signs to look for?
Strange memory errors after file-upload requests, oversized session cookies, and PHP workers that keep restarting. Wiz lists these as signals that "can guide an investigation."3 They're signs of an attack attempt, not proof of a break-in. Treat a hit as the reason to look closer.
Sign 1: Memory errors or "500" errors right after odd upload requests
Unusual requests in the format used to send files (multipart/form-data), followed by "memory limit exceeded" errors or repeated HTTP 500 server errors.3
Sign 2: A "PHPSESSID" cookie that's unusually long or garbled
PHPSESSID is like the ticket number a site uses to tell visitors apart. Normally it's a short string of a fixed length. Unexpectedly large or malformed ones in your logs may mean someone tried the attack.3
Sign 3: PHP workers restarting over and over
The programs that run PHP (workers) stopping and starting many times in a short period, which Wiz calls "unexplained PHP worker churn."3 CISA adds one more thing to watch for: PHP worker processes launching shells or downloading tools.4
Jeensuk's takeAll three live in the logs. That's why step one, saving them, comes first.
Besides the three signs, what else should you check?
PHP files you don't recognize and admins you don't recognize. CybelAngel suggests looking back to at least June 2026, just to be safe.5
- Unfamiliar PHP files: new or modified PHP files where there shouldn't be any, such as your uploads folder. These can be web shells, back-door files used to control a site remotely.5
- Unfamiliar admin users: a new administrator in your WordPress user list that nobody on your team created.5
- Odd connections out: your server reaching out to addresses it never used to, or the web server starting unexpected programs.5
If anything looks wrong, don't just wipe it and move on. Isolate the affected system, preserve the evidence, and change the passwords and keys that may have been exposed: database, WordPress admin, API keys.6 To report it, the FBI's Internet Crime Complaint Center (IC3) is "the central hub for reporting cyber-enabled crime,"7 and CISA takes incident reports through its online form.8
On shared hosting, who does what?
| Step | On shared hosting, who does it |
|---|---|
| 1. Save the logs | Ask your host |
| 2. The three signs | Ask your host |
| 3. Files and users | You (WordPress dashboard, file manager) |
| 4. Passwords and keys | You |
| 5. If something's wrong | Your host + a security professional |
For perspective: CISA had not seen a successful attack when it published its alert,4 and Hostinger saw no rise in malware or unusual activity on its managed hosting after the bugs went public.9 Most businesses will find nothing.
Jeensuk's takeOn shared hosting you usually can't see the server's own logs. Do steps 3 and 4 yourself and ask your host about the rest. And since keys in memory could leak, changing your admin and database passwords is a cheap step worth taking even if you find nothing.
So what should your business do?
You have three ways forward.
Work through the five steps with whoever can handle your server.
"Did you save the logs from October 20 on?" and "Did you check for the three signs Wiz listed?"
A static site without PHP has nothing that runs PHP files, so a back-door file like this one simply doesn't work.
Jeensuk's takeYou can make this check the last one. Pick a setup that doesn't need it every time, and there's far less footage to rewind.
Frequently asked questions about checking for a break-in
If I find one of the three signs, was my site hacked?
Not necessarily. It's a sign of an attack attempt, not proof of a break-in. Use it as the reason to check files and users more closely.
If something looks wrong, should I just shut the server down?
Not before you've saved the evidence. Isolate the system from the network, keep the logs, and get a professional involved. Shutting down or rebuilding first can erase the clues.
I'm on shared hosting and can't see the logs. What now?
Ask your host about saving the logs and checking for the signs. Checking for unknown files and admins, and changing passwords, you can do yourself.
SOURCES
- Wikipedia, "Normalcy bias" wikipedia.org
- TechTarget, "PHP2Shell: 22M exposed servers at risk as emergency patches released" (Oct 21, 2026) techtarget.com
- Wiz Research, "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet" (Oct 21, 2026) wiz.io
- CISA, "Critical Vulnerabilities in PHP Require Immediate Patching" (Oct 21, 2026; last revised Oct 23) cisa.gov
- CybelAngel, "2.24M Internet-Facing PHP Hosts, 59% on Versions With No Fix Coming: What We Know About php2shell" (Oct 21, 2026) cybelangel.com
- ThreatLocker, "PHP2Shell: Why organizations must patch critical PHP vulnerabilities now" (Oct 21, 2026) threatlocker.com
- FBI, Internet Crime Complaint Center (IC3) ic3.gov
- CISA, "Report a cyber issue" cisa.gov
- Hostinger, "Hostinger deploys protections against php2shell PHP vulnerabilities" (Oct 21, 2026; updated Oct 23) hostinger.com
Five articles on what PHP2Shell means for small business websites. More English editions are on the way.
- What is PHP2Shell? What it means for your business website
- Patched, but still not safe? Three cases (coming soon)
- Why PHP sites on a VPS or your own server are still at risk (coming soon)
- What if someone got in before the patch? Three signs (this article)
- PHP 8.2 support ends Dec 31: what to decide now (coming soon)
More articles on the ATATAKAI Digital blog.
Not sure you can run this check on your own?
Enter your site address and we'll tell you right away whether it runs on PHP and where your host stands. If you're not affected, we'll say so plainly: "No need to move right now."
Run the free 30-second checkWant to talk it through after you see the result? Contact ATATAKAI Digital
Updated Oct 26, 2026
