PHP2Shell response for business websites and agency portfolios. Get a clear answer, a carefully scoped update, and proof of what changed.
Patched. Checked.
Documented.
8.3.358.3.36For the PHP you run every day
A fully updated website can still run on an unpatched PHP runtime. We establish what your web server actually uses, then agree on the right next step.
Understand PHP2ShellIdentify the PHP build serving your application, including separate pools and containers within the agreed scope.
Vendor backports matter. We check package provenance and security advisories, not just a version number.
Document the update, confirm restarted processes, and check the application paths your business relies on.
No changes without an agreed scope.
No handover without a written record.
We review your web runtime and vendor patch status. You get a clear outcome: patched, needs action, or requires more evidence.
Agree the maintenance window, prepare a backup and rollback plan, and apply a supported update to the scoped environment.
Confirm the running version, test the agreed application functions, and receive a concise change report with any remaining actions.
Start with one environment.
Scale to your client portfolio.
A clear answer
€190 / one-time
Know what needs attention before making changes.
Start with a verificationThe complete standard update
From uncertainty to action
€590 / one-time
A scoped update, with your application checked afterwards.
Request a patch assessmentFor your client portfolio
€1,490 / one-time
One view of the PHP environments you look after.
Discuss your portfolioPrices exclude applicable taxes. Standard remediation covers one supported server and one application, subject to assessment. Major upgrades and incident investigation are quoted separately.
Full service scopeWhen every client asks the same question, you need a coordinated response. Get a portfolio inventory, a prioritised plan, and reports ready to share under your name.
Let’s review your portfolio Start with one agreed pilot. Expand with confidence.Understand the scope
before you commit.
Not on its own. These vulnerabilities affect the PHP runtime beneath your application. WordPress, plugin and theme updates do not replace the required PHP security update.
Your hosting provider may already have handled it. Ask for confirmation covering your actual PHP runtime and package. If you have that evidence, you may not need our service. Verification is useful when the status is unclear or you need a documented view across several environments.
Cloudflare has deployed WAF mitigations, but also recommends patching PHP. A firewall is an additional layer of protection, not evidence that your PHP runtime has been updated.
We check whether a supported vendor security backport is available. If a larger upgrade or application change is needed, we scope it separately. Major PHP migrations, operating-system upgrades and application rewrites are not included in the standard patch package.
We confirm availability after reviewing your environment. The agreed work window depends on scope, access and backup readiness. We do not make changes before the scope and maintenance window are approved.
No. Verification documents the patch status and agreed functional checks. A previous compromise requires a separate investigation. If we see signs that warrant investigation, we flag them and discuss the next steps.
Technical guidance reviewed 22 October 2026. Refer to the PHP advisory for the latest information. Managed hosting may already include the required update.