Home / PHP security fixes
PHP security fixes & upgrades
Fix PHP security vulnerabilities, fast.
Worried about this week's php2shell flaws or an outdated PHP version? We patch or mitigate first, check whether anyone got in, then make sure it doesn't happen again.
- Priority response for active issues
- Fixed price agreed up front
- Tested on a copy first
$ pydev fix https://example.com PHP 8.1.31 detected, no upstream fix → mitigate: firewall rule for php2shell done → upgrade: PHP 8.1 → 8.4.27 done → compat: 3 plugins updated, 1 replaced done → scan: no web shells, no new admins clean ✓ Patched, hardened and monitored
About php2shell
What happened, and who is exposed
On 21 October 2026 the PHP project released emergency updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), nicknamed “php2shell”. They allow remote code execution without logging in, and exploitation attempts have been reported.
Every PHP installation that serves web requests is affected until it is upgraded, whether it runs PHP-FPM, Apache mod_php, php-cgi, FrankenPHP or LiteSpeed.
What we do
From emergency patch to a hardened site
We work on any PHP stack (WordPress, WooCommerce, Drupal, Joomla, Magento, Laravel, Symfony or custom code) on shared hosting, a VPS or the cloud.
Emergency patching
Upgrade PHP to a fixed release on your server, VPS or hosting panel, then test that the site still works.
Temporary mitigation
When an upgrade can't happen right away: firewall rules, blocking exploit traffic, or isolating the site.
Compromise check
We look for web shells, unknown admin accounts, modified files, injected code and suspicious scheduled jobs.
Clean-up & recovery
Remove backdoors, restore clean files, rotate passwords and keys, and request removal from blocklists.
End-of-life PHP upgrades
Move PHP 7.x, 8.0 and 8.1 sites to a supported version, fixing incompatible code, plugins and themes.
Hardening
Security headers, disabled risky PHP functions, least-privilege file permissions and login protection.
Send your URL
Use the form below. A website address and a few words are enough.
Triage
We confirm the PHP version, hosting and exposure, and tell you the risk.
Patch or mitigate
At a fixed price agreed before we touch anything.
Verify & harden
Compromise check, hardening and, if you want it, ongoing maintenance.
FAQ
PHP security questions
Will updating WordPress or my plugins fix php2shell?
No. php2shell is in the PHP runtime itself, not in WordPress or its plugins. The server needs PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer.
My hosting company manages PHP. What should I do?
Check which PHP version your site uses (most hosting panels show it) and whether your host has applied the fix. Many panels let you switch versions yourself; we can do it for you and test the site afterwards.
Our site runs PHP 7.4 or 8.0. Can it be upgraded?
Usually, yes. Older code and plugins may need fixes to run on a supported PHP version, so we test on a copy first and the live site isn't broken.
How do we know if we were already hacked?
Warning signs include unknown admin users, new files in upload folders, unexpected redirects or spam pages, and security warnings from Google. Many compromises show none of these, so we check the files, database and logs directly.
Contact
Book a website security check
Tell us your website address and what's worrying you. For a small fixed fee, we check it and reply with what we found and what we recommend.
- Send the formYour website address and a short description are enough.
- We check your siteA non-intrusive outside check of PHP and server versions, CMS, TLS and security headers.
- You get a clear answerWhat's at risk, what to fix first, and a fixed price if you want us to do it.
Existing customer? Visit support.pydevsolutions.com.