21 October 2026: two critical PHP flaws disclosed, php2shell.
Is your site running a PHP version exposed to php2shell?
Two critical PHP flaws, exploitable without a password, let an attacker take control of the server. I check your site's version and, within 24 hours, tell you whether you're exposed and how to close it.
- Two flaws found in the core of PHP, the language most websites run on (WordPress, WooCommerce, PrestaShop). They're critical, scored 9.2 out of 10, and the problem is in PHP itself, not in a plugin. An attacker can exploit them with a single request, without a password and before your site runs a single line of its own code. The name says it all, “PHP to shell”: getting a command line on your server. PHP released the fixes on 21 October 2026.Two critical flaws in the core of PHP (scored 9.2), exploitable with a single request without a password. “PHP to shell”: taking control of the server. Patches released on 21 October 2026.
- php2shell affects almost every version of PHP, from 5 onward. The fixes are in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If you're running PHP 8.1 or earlier, PHP no longer releases official updates for your version: you're exposed, and the clean route is to move to a supported branch. From the public version I can see which branch you're on; if it's a supported branch, I check with you whether the patch is already applied.Affects almost every version. Fixed in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; on 8.1 and earlier no official patch. I see your branch from the public version.
- It's the right worry, and the reason so many put it off. A version jump can stop an old theme or plugin from working. That's why you don't update blind: you work on a copy of the site, check that everything holds, and switch over only when it's ready. In normal cases visible downtime is zero. If something isn't compatible I find out before, not after.You work on a copy, check everything and switch over when it's ready. In normal cases zero downtime. I find incompatibilities before.
- Sometimes a host pushes the upgrade even when it isn't urgent. With php2shell, though, it isn't a sales move: it's a real flaw, a critical score, with attacks already underway. That's exactly why the analysis is free: I'll also tell you when nothing needs doing, or when applying the patch is enough without redoing anything. If it's just the host wanting to sell you a package, I'll tell you.With php2shell it's not marketing: it's a real flaw with attacks underway. The analysis is free and I'll also tell you when nothing needs doing.
- Applying the patch or updating PHP on a site that can take the jump starts at €150. If the site is so dated that it also needs the CMS or plugins migrated, it depends on the scope, and I tell you up front with a fixed price. The analysis to work out which of the two cases you're in is free.From €150 for a patch or update. If the CMS or plugins need migrating it depends on the scope, fixed price agreed up front. The analysis is free.
How I work.
Free analysis
I check your site's PHP version from the public signals and, within 24 hours, tell you whether you're exposed to php2shell and what's worth doing. Plainly, no sell-everything.
Fixed quote
One price, agreed before I start. No billing by the hour, no surprises.
Fix and handover
I work on a copy, apply the patch or update the version, check that everything holds and switch over when it's ready. I leave you a site that's up to date and easy to manage.
Not sure where to start?
Let's talk for 15 minutes: tell me about your business and I'll tell you what could be done, and in what order I'd do it. Each one has a fixed price, and you decide whether to go ahead, and with what.Tell me about your business and I'll tell you what to do first, each at a fixed price. Then you decide.