Is your PHP site exposed to PHP2Shell?
Two critical vulnerabilities in PHP allow attackers to take over the server remotely. Almost every PHP version from 5.4 to 8.5 is affected, including sites built on WordPress, Drupal, Joomla or Laravel. We apply the patch, check whether you have already been compromised and keep your servers up to date.
Is your site vulnerable?
Enter your website address and we analyse it right now: whether it runs on PHP, which version it exposes, which platform it uses and whether it is affected by PHP2Shell.
The check is passive: we only read what the homepage publicly sends (HTTP headers, cookies, HTML), exactly like a browser. We send no attacks and make no exploitation attempts. The address you enter is not stored.
Two flaws in PHP that lead to server takeover
The problem is not a plugin or a theme, but PHP itself. That is why what matters is the PHP version your server runs, not which application you use.
Memory corruption on out-of-memory
When PHP runs out of memory at the wrong moment, execution can stop while internal request data is only partially initialised. During cleanup, PHP may treat that invalid data as valid. An attacker can trigger this situation on purpose.
Global state reused between requests
Part of a request's internal state can survive after its memory has been freed, and a later request can reuse it. Combined, the two flaws can lead to code execution on the server.
Already exploited
Details leaked before the coordinated disclosure. Security firms have observed real attacks, and Cloudflare reports malicious traffic targeting these vulnerabilities.
Full control of the server
An attacker can run code on the server: steal databases and customer data, install web shells, spam tools or crypto miners, and attack other sites hosted on the same server.
Patching is not enough
If the server was compromised before the update, the attacker can stay in the system afterwards. The UK NCSC recommends taking offline any systems that cannot be updated immediately.
Platforms affected when running on a vulnerable PHP version:
From emergency patching to long-term peace of mind
We fix PHP2Shell now, then help you avoid ending up in the same situation with the next vulnerability.
Emergency patching
We update PHP to the fixed version (8.2.35, 8.3.36, 8.4.27 or 8.5.12) on VPS, dedicated servers or shared hosting, in an agreed maintenance window and with a backup first.
Compromise audit
We look for traces of attack: web shells, modified files, new admin users, suspicious cron jobs, outbound connections from the server and anomalous log entries.
Migration from old PHP
PHP 7.x, 8.0 and 8.1 have no official patch in the list of fixed versions. We migrate your application to a supported version and fix incompatibilities in code, themes and plugins.
Hardening & WAF
We configure WAF rules, memory and execution limits, disable_functions, correct permissions and isolation between sites, to reduce the impact of future vulnerabilities.
Security maintenance
Monthly updates for PHP, the operating system, CMS and plugins, file integrity monitoring, verified backups and alerts for new vulnerabilities.
Incident response
If you have already been attacked: we isolate the server, remove the attacker's access, clean or rebuild the environment, rotate credentials and help with any UK GDPR breach notification to the ICO.
Clear prices, no surprises
Indicative prices per server. You receive the final quote after the contract and NDA are signed and after the free on-server check, before any intervention.
Emergency patch
- Inventory of PHP versions on the server
- Full backup before the intervention
- Update to the fixed PHP version
- Testing that the sites work
- Priority intervention, as soon as possible
Patch + audit
- Everything in Emergency patch
- Full scan for web shells and malware
- Access log analysis for the exposure period
- Review of users, cron jobs and connections
- Basic PHP and server hardening
- Written report with findings and recommendations
Security maintenance
- Security patches applied monthly
- Alerts and response for critical vulnerabilities
- Uptime and file integrity monitoring
- Daily backups with a monthly restore test
- Monthly security report
Prices exclude VAT. Several servers or a complex environment? Ask for a custom quote.
Six steps, no panic
We do not access any system or run any check on your servers without a signed contract and a non-disclosure agreement.
Online check
Check your site here or send us the form. From the outside we can see whether you are likely exposed, without any access to your systems.
Contract and NDA
Before any check on the server we sign the contract, the non-disclosure agreement (NDA) and the data processing agreement (DPA).
Check and quote
We check the server for free and you receive the concrete steps, risks, maintenance window and final price.
Backup and patch
We back up, update PHP and test that everything works as before.
Audit
We check whether attackers got there before us and clean up any traces we find.
Ongoing protection
Optionally, we stay with you through monthly maintenance and alerts for new vulnerabilities.
We sign before any check
Security starts with a clear legal framework. You receive the documents for electronic signature as soon as possible, with no travel and no paperwork.
What our clients ask
My WordPress and plugins are up to date. Am I safe?
Not necessarily. PHP2Shell is a vulnerability in PHP, not in WordPress. What matters is the PHP version your server runs. A fully updated WordPress on PHP 8.2.20, for example, is still vulnerable.
How accurate is the check on this site?
The check only reads the public information of the homepage. When the server exposes its PHP version, the result is clear. Many servers hide it, though (which is good practice), and Debian or Ubuntu packages may include the fix without changing their version number. In those cases a reliable confirmation is done directly on the server, and the manual check is free.
I am on shared hosting. Doesn't my hosting company handle this?
Some companies update automatically, others do not, and many leave the PHP version up to the customer. Sometimes the server has newer versions installed, but your site still runs on an old one. We check exactly which version each site uses and help you move to a safe one.
I run PHP 7.4 / 8.0 / 8.1. What should I do?
No official patch has been published for these versions in the list of fixed versions (8.2.35, 8.3.36, 8.4.27, 8.5.12). The safe solution is migrating to a supported version. Usually this means updating some plugins, themes or pieces of code. We handle compatibility, and until the migration we can apply temporary measures that reduce the risk.
How long does it take and will the site go offline?
A PHP update on a single server usually takes between 30 minutes and a few hours, with interruptions of a few seconds (restarting PHP-FPM or the web server). We work in the window you choose, including at night or at weekends.
Why do an audit if I have already applied the patch?
The vulnerability was exploited before the patch was released. If an attacker got in meanwhile, they may have left a web shell or a hidden account that keeps working after the update. The audit confirms the server is clean.
Do you need access to the server? What guarantees do I have?
The online check on this site needs no access at all. For the on-server check, patching and audit we need SSH or hosting panel access, but only after the contract, the non-disclosure agreement (NDA) and the data processing agreement (DPA, Art. 28 UK GDPR) are signed. Access goes through secure channels and is logged, and at the end we recommend changing the passwords used.
How do you handle my customers' personal data on the server?
When we work on your server we act as a processor (Art. 28 UK GDPR). We work only under the signed data processing agreement, we do not copy databases off the server unless you explicitly ask us to (for example for a backup), and we delete any temporary copy at the end of the intervention. If we discover a compromise, we help you assess whether you need to report it to the Information Commissioner's Office (ICO) within 72 hours.
Do you issue invoices? Do you work with individuals?
Yes, we issue invoices for all services. We work with UK businesses, web agencies, online shops and sole traders who run their own website or server.
Tell us about your sites. We reply fast.
Fill in the form and we will send you the contract and NDA for electronic signature as soon as possible. Once signed, we check for free whether you are exposed to PHP2Shell and tell you what needs to be done and what it costs.
-
Reply as soon as possibleUrgent requests are handled with priority.
-
Contract and NDA before any checkWe never ask for passwords in the form. Access is set up only after the documents are signed.
-
Prefer email?[email protected]
Every day without the patch is a day of exposure.
Automated attacks are scanning the internet right now. The check takes a few minutes.