Last updated: 21 October 2026
PHP Emergency Patch & Audit
On 21 October 2026 the PHP project released security updates (8.5.12, 8.4.27, 8.3.36, 8.2.35) for critical flaws in the PHP engine itself, whatever framework runs on top. We check which PHP versions your servers run, apply the update or a temporary mitigation, look for basic signs of compromise and give you a written report with an upgrade plan.
Book a check
What we do
Inventory. PHP version and how it runs (PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed) on every server, container or hosting account you name.
Patch. Update to the fixed PHP release or your distribution’s package. On PHP 7.4, 8.0 and 8.1, the published backport where your setup allows it.
Temporary mitigation. Where an update cannot happen right away, we apply the PHP project’s published mitigations and document them as a stopgap, not a fix.
Basic compromise check. Unusual processes started by the web server, new or changed webroot files, new cron jobs or accounts, suspicious log patterns.
Written report. What we found and changed, what is still open, and an upgrade plan for end-of-life PHP.
What we do not promise
No full forensic investigation. If we find signs of compromise, we tell you immediately and recommend next steps (preserve logs, rotate credentials, involve an incident response specialist).
No guarantee that a system was never compromised. A basic check reduces uncertainty. It cannot rule everything out.
No “100% secure”. Updating to the fixed version reduces the risk. It does not make any system immune.
No scanning without consent. We only work on systems you own or manage, after written confirmation.
Who it is for
Businesses running WordPress (incl. WooCommerce), Laravel, Magento or custom PHP on servers, VPS, containers or shared hosting. Especially if you are on end-of-life PHP 7.4, 8.0 or 8.1 (no official release) or PHP 8.2 (end of life on 31 December 2026).
Our services are offered exclusively to businesses (B2B).
How it works
Contact. Send the form below. We reply and agree scope and price before any work starts.
Secure access. We agree a secure access method, for example a temporary SSH user with our public key or a collaborator role in your hosting panel. We remove it when we are done.
Patch. We update or mitigate, check that your site still works, and change only what is needed.
Written report. Delivered in English, German or Romanian.
More background in our guide: What PHP2Shell means for your site and what to check today
Frequently asked questions
How do I find out which PHP version my site runs?
In WordPress, open Tools, then Site Health, then Info, then Server. Most hosting panels show the PHP version in their PHP settings. If you are unsure, ask your hosting provider for the exact version, for example 8.3.36, not just 8.3.
Is a temporary mitigation enough?
No. The mitigations published by the PHP project reduce the risk until you can update, but they do not make the installation secure. The only complete fix is updating to a patched PHP version.
Can you tell me whether my site was hacked?
We check common signs of compromise: processes, webroot files, cron jobs, accounts and logs. This is a basic check, not a full forensic investigation, so we cannot guarantee that a system was never compromised. If we find indicators, we tell you immediately and recommend next steps.
Do you need my passwords?
Never send passwords through this form or by email. After the first reply we agree a secure access method, for example a temporary SSH user with our key, and we remove that access when the work is done.
Not sure where you stand? Tell us what you run.
We confirm scope and price before we touch anything.
