Joomla updates replace PHP files. The interpreter configured for the site is a separate package, often chosen in a panel.
What to look at
System information inside Joomla prints a PHP version. Match it to the handler. Older Joomla 3 sites are a frequent reason a host still offers PHP 7.4 or 5.6.
Remediation
If the site can move to a fixed 8.x runtime, test extensions on staging first. If it cannot, ask whether the host’s 7.4 or 5.6 build has a vendor advisory. Do not stay on an unpatched handler because an extension directory is quiet.
Nginx or Apache in front of Joomla is still only the proxy or the module loader. Follow the web server guide that matches the handler you found. Temporary PHP settings remain incomplete if the provider cannot patch this week. CISA’s 21 October 2026 alert said internet-facing PHP that cannot be updated should be taken offline until it can. That is a business decision for a store or a campus site, and it is the alternative to pretending the application update was enough.
Questions
Does updating Joomla fix PHP2Shell?
No. Joomla runs on PHP. The PHP binary or package that serves it has to be patched or replaced.