Critical PHP flaws disclosed 21 October 2026

Is your website exposed to PHP2Shell?

Two critical flaws in PHP, the software behind most business websites including WordPress, let an attacker take over an unpatched server with a single request. Attacks have already been seen in the wild. We check your site and patch it the same day.

Check my website

Same-day turnaround

Full backup first

Already patched? No charge

Free exposure check

Enter your web address for a quick first look.

Many servers hide their PHP version or report an old number even after patching, so we always confirm by hand before recommending any work.

How it works

Patched in three steps

You don't need to know anything technical. Send us your web address and we handle the rest, or deal with your host for you.

STEP 1

We check your site

Send us your web address. We confirm the same day whether your server is running a vulnerable version of PHP.

STEP 2

We apply the patch

We take a full backup, then update PHP to the patched release on your existing version line. On shared hosting, we get your host to do it.

STEP 3

You get a report

We test your site afterwards and send you a short before and after report for your records or your insurer.

Why it matters

An unpatched server is an open door

PHP2Shell hits PHP before your website's own code even runs, so security plugins and strong passwords don't stop it. Patched releases came out on 21 October, but not every host has rolled them out yet.

Your site looks and works exactly the same afterwards
Full backup taken before anything changes
Security patch only, not a major PHP upgrade
Nothing done without your written go-ahead

Pricing

One flat price

No hourly rates and no surprises. Agencies with several client sites, ask us about volume pricing.

PHP2Shell patch & verification

£199 per website

Exposure check confirmed by hand
Full backup before any change
PHP updated to the patched release
Site tested afterwards
Before and after report

Get started

If your site is already patched, you pay nothing.

FAQ

Common questions

What is PHP?

It's the engine most websites run on, including every WordPress site. You never see it, but it's where these flaws are.

Will my website change?

No. Visitors won't notice anything. We apply a security patch on the version line you already use, not a major upgrade.

What if something breaks?

We take a full backup before touching anything. If anything misbehaves afterwards, we roll it back.

I'm on shared hosting. Isn't this my host's job?

It is, and some hosts have already done it. We'll check whether yours has, and if not, we'll chase them for you.

How do I pay?

Once we've confirmed your site needs the patch, we'll send you a payment link or bank details. If it's already patched, there's nothing to pay.

Do you need my passwords?

Only server or hosting access, and only after you've agreed in writing. We never ask for card details or banking passwords.