Emergency PHP security updates
When a critical PHP vulnerability is disclosed, every hour counts. That was the case on October 21, 2026 with PHP2Shell: two vulnerabilities that allow code execution on the server without authentication. We check which PHP version runs on the server and how, update it to a fixed release, and if an update is not possible right away, we apply the interim measures from the PHP team and plan the move. Old PHP 7.4–8.1 branches are moved to supported versions with code and extension checks.
What's included
- Quick server check: PHP version, how it runs (mod_php, PHP-FPM, php-cgi) and whether the vulnerability affects it
- PHP update to a fixed release, from distribution packages, a Docker image or built from source
- Interim measures if you cannot update right away: php.ini and FPM pool settings, request limits on the web server
- Moving from old PHP 7.4–8.1 branches, which no longer receive fixes, to supported versions
- Code and extension compatibility checks, staging and production rollout with a rollback plan
- Checking site logs and files for signs of compromise after the update
Technologies
How we work
- 01
Brief and estimate
We look at the task, your current system and constraints, then name the timeline and budget and suggest how to work together.
- 02
Specification
We capture requirements and acceptance criteria in a specification — it is what we build against and how the result is accepted.
- 03
Iterative development
You see the result after every iteration; we test and fix before anything goes into a release.
- 04
Launch and support
We ship with no downtime, monitor the product after launch and stay on for support if you need it.
Cost and timeline
Hourly Rates: from $40 to $80 / hour — depending on specialist qualification.
We give an exact timeline and budget after a brief: we break down the task, fix the scope and suggest a format — a fixed plan or hourly work.
See plansFAQ
Is my site affected by PHP2Shell?
All PHP installations serving web requests are at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The fixes were released on October 21, 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your site runs an earlier PHP version, it needs an update.
How quickly can PHP be updated?
An update within a branch, for example from 8.3.x to 8.3.36, usually takes hours. Moving from an old 7.4–8.1 branch takes longer: first we close the vulnerability with interim measures or the fixes for old branches, then we move the project to a supported version.
What if I cannot update PHP right now?
The PHP team lists interim measures: the memory_limit, post_max_size and session.upload_progress.enabled settings, plus fatal_error_backtraces on PHP 8.5. They block the known attack paths but do not make the server safe: only an update fully removes the vulnerabilities.
Emergency PHP security updates
We urgently update PHP to releases with security fixes: Magento, Laravel, WordPress, OpenCart and custom sites, with compatibility checks and a rollback plan.