Two critical flaws in the PHP runtime let an attacker run code on your server with a single crafted web request, without logging in. We find every place you run PHP, patch it, check for signs of past compromise, and upgrade legacy PHP applications that can't simply be patched.
The flaws are in PHP itself, not in WordPress, Magento or your own code, so keeping your application up to date doesn't protect you. Every way of serving PHP over the web is affected: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
8.5
8.5.12
Patch Upgrade to 8.5.12 or later
8.4
8.4.27
Patch Upgrade to 8.4.27 or later
8.3
8.3.36
Patch Upgrade to 8.3.36 or later
8.2
8.2.35
Patch Upgrade to 8.2.35 or later
8.1 and older
No official fix
Upgrade Move to a supported branch, or rely on a
vendor backport as a stopgap
Sources: BleepingComputer, Dark Reading. Always confirm against the official PHP release notes for your branch.
Every engagement is scoped to your estate and quoted up front. Start with an assessment, or go straight to the fix if you already know what you run.
A clear picture of your exposure and what to fix first.
For sites on PHP 8.2 or newer: get onto a fixed release quickly and safely.
For PHP 8.1 and older, where there's no patch to apply: we move you and your application forward together.
We serve UK and international clients remotely, working within your change-control process and with access you grant and can revoke.
We learn what you run, where it's hosted and who looks after it, then send a fixed quote.
With your written authorisation, we inventory your PHP estate and check for compromise.
We patch or upgrade in staging first, test with you, then roll out to production.
We confirm every instance is fixed and hand over a report you can share with your board or insurer.
No. PHP2Shell is a flaw in the PHP runtime that runs your application, not in the application itself. You need a fixed PHP version as well as an up-to-date application.
Ask your host which PHP version each of your sites runs and when it was patched. Many hosts let customers pin older PHP versions, and those may not be upgraded automatically. If you'd like, we can handle that conversation for you as part of an assessment.
There is no official PHP fix for these branches. Some operating-system vendors ship backported patches, which can buy time, but the lasting fix is to move to a supported PHP branch. That usually means updating the application and its dependencies too, which is what our upgrade service covers.
Yes. Patching stops new attacks but doesn't remove anything already planted, and the flaws can expose secrets held in memory. Our assessment includes compromise checks and a list of credentials to rotate.
No. We only test systems you own or control, and only with your written authorisation.
It depends on how many sites and servers you have and which PHP versions they run. Tell us about your setup and we'll send a fixed quote, usually within one business day.
A rough picture is enough: how many sites, which PHP versions if you know them, and where they're hosted. We'll reply within one business day with next steps and a quote.