PHP2Shell is a pair of remote code execution flaws in the PHP interpreter, so on shared hosting a WordPress or Joomla update leaves you exactly as exposed as before. If attackers reached your server before your host patched, the passwords and keys that server could read are the loss that matters.
