PHP2Shell: Secure Your PHP Website Today

Two critical PHP flaws allowing unauthenticated remote code execution have been patched. We update your site, scan for signs of compromise and keep it protected.

Get a Free Quote WhatsApp

PHP2Shell is the name given to two critical vulnerabilities in PHP installations that serve web requests. They allow an attacker to run code with the web server account’s privileges using a single unauthenticated request. Because the flaws are in the PHP interpreter itself, every PHP-based site is in scope — WordPress, WooCommerce, OpenCart, Laravel, Drupal or custom code alike. Researchers also showed that PHP worker memory can be leaked, which may expose passwords, session tokens and API keys.

The PHP project released patched versions on 21 October 2026 and stated that there are no complete mitigations: updating is the only safe option. These updates are not applied automatically — your server administrator, hosting provider or Linux distribution packages must be updated. PHP 8.1 and older are end-of-life, so the lasting fix for those sites is moving to a supported version.

GosterGe.net has built and hosted PHP websites since 1996. We identify your PHP version, apply the emergency patch, fix compatibility issues in older code, scan for signs of compromise and harden your server against the next vulnerability. We work remotely with sites hosted anywhere in the world.

Which PHP versions are safe?

PHP branch Patched (safe) version Status
8.5 8.5.12 or later Supported
8.4 8.4.27 or later Supported
8.3 8.3.36 or later Security fixes only
8.2 8.2.35 or later End of life on 31 December 2026
8.1, 8.0, 7.x and older No official patch End of life: upgrade, or a distribution/provider backport

For CVE-2026-115560, announced on 23 October 2026 and not yet patched, the PHP team recommends setting session.upload_progress.enabled=0 until the next release.

What We Do

Emergency Patching & Updates

We move your site to a patched PHP version as quickly as possible.

  • PHP version check
  • Upgrade to a patched 8.x release
  • cPanel, DirectAdmin, Plesk servers
  • OS package updates

Legacy PHP Upgrades

Move PHP 5.x / 7.x sites to a supported version.

  • PHP 8.3 / 8.4 migration
  • Code compatibility fixes
  • WordPress, OpenCart, Laravel updates
  • Testing on a staging copy

Compromise Scanning

Could your site have been breached before the patch?

  • Web shell and backdoor scanning
  • Detection of modified files
  • Server log analysis
  • Rotation of passwords and API keys

Server Hardening

Limit the impact of the next vulnerability.

  • Per-site isolation with PHP-FPM
  • disable_functions, open_basedir
  • session.upload_progress mitigation
  • File permission clean-up

WAF & 24/7 Monitoring

Stop attacks before they reach your server.

  • Web application firewall (WAF)
  • File integrity monitoring
  • 24/7 monitoring and alerts
  • Incident response

Security Maintenance Plan

We track updates so you don’t have to.

  • Regular PHP and CMS updates
  • Automated backups
  • Security advisory tracking
  • Priority emergency response

How We Work

1

Free initial assessment

Send us your site and hosting details; we assess your risk.

2

Emergency patch

We update PHP and make your code compatible if needed.

3

Scan & clean-up

We look for signs of compromise and rotate secrets.

4

Lasting protection

Hardening, WAF, monitoring and regular maintenance.

Frequently Asked Questions

Your hosting control panel shows which PHP version your site uses. If it is older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35, your site is at risk. Send us your site address and we will do a free initial assessment.

Updating PHP on the server is your hosting provider’s responsibility — ask whether they have applied the patch. If an older PHP version is selected in your panel, switch to a patched one. If your site needs code changes to run on the newer version, we can do that for you.

The PHP project does not publish patches for these versions; some Linux distributions and providers may have backported fixes. The lasting solution is moving your site to a supported version (8.3 or 8.4). We handle code compatibility fixes and testing.

Exploitation attempts started before the patch was released, so your site may already have been compromised. We recommend scanning for web shells and backdoors and rotating database passwords and API keys.

No. The flaw is in the PHP interpreter, not in your site’s software. CMS updates matter, but they do not fix PHP2Shell — the PHP version on the server must be updated.
Sources: php.net security advisory Help Net Security SecurityWeek

Get a quote for PHP2Shell & PHP Website Security

Fill in the form and we will get back to you shortly. You can also call us on +90 (506) 292 66 99.

Call Get a Quote