NextSupportCritical PHP flaw. We update your website for you.
The php2shell flaw lets an attacker into the server without a password. It affects sites on WordPress, Joomla and custom PHP applications. We back up your site, upgrade it to a supported PHP version, check it and hand you a written report.
Warnings have been issued since 21 October 2026 by CERT-EU and national cyber security agencies across Europe, including Germany’s BSI, the UK and Dutch NCSC and the Czech NÚKIB.
The check takes a few seconds and is free.
Is my website affected?
Enter your website address. We check whether it runs on PHP and, if the server discloses the version, compare it with the patched versions.
We load only the public home page of the site, just like a regular browser. We do not test or change anything. The check takes a few seconds.
A strong password will not help this time
No password needed
The flaw is in PHP itself. A strong admin password or a security plugin will not help: the attack happens before the site even checks the login.
The details are public
Details leaked before fixes were released and proof-of-concept code is circulating. Security firms are already reporting attack attempts.
Old versions get no new release
PHP 8.1 and older get no new official release. Only some hosting providers patch them, so sites on these versions should move to a newer one.
Four steps, no experiments on your live site
- 1Backup
Before we touch anything, we back up the site's files and database.
- 2Upgrade to new PHP
We switch to a supported version (8.3 or 8.4). Not 8.2, which reaches end of life on 31 December 2026.
- 3Site check
We go through the home page, key subpages, forms, the admin and the error log.
- 4Report
You get a written summary: what we did, from which version to which, and what we recommend next.
Fixed price, no surprises
Checking whether you are affected is free. You know the price of the work up front.
PHP Rescue
A site on hosting with a control panel, WordPress or a simple site on PHP 7.4 to 8.x.
- Backup of files and database
- Upgrade to PHP 8.3 / 8.4
- Check of the site, forms and admin
- Error log review
- Written report
- Roll back to the original state if the site does not run
PHP Rescue+
When a plugin, theme or part of the code stops working after the upgrade.
- Everything in the basic service
- Up to 2 hours of compatibility fixes
- Plugin and theme updates
- Check for signs of compromise
- Recommendations for the site going forward
Legacy site or own server
Custom applications, Joomla 3, an old e-shop, PHP 5.x to 7.3, or a virtual server without a control panel.
- Migration of the application to new PHP
- Access limited to selected IP addresses until migrated
- Brochure sites converted to static, without PHP
- PHP updates and patches on your own server
- We estimate the price before we start
We work only on the basis of your order and with the consent of the site owner.
Warning in the evening, updated overnight
The fixes came out on 21 October and the Czech NÚKIB issued its warning that evening. That same night we went through every site and server we manage, and we now offer you the same procedure.
- Web servers running PHP updated the same night, one by one and always with a backup first
- Live sites down for only a few seconds, while they restarted
- An older application restricted to branch office IP addresses until it is migrated
- Simple brochure sites converted to static, without PHP
- Always the test environment first, only then the live site
What people ask us
- How do I know if I am affected?
- It affects sites on WordPress, Joomla, Drupal, self-hosted e-shops (WooCommerce, PrestaShop) and web applications in PHP. It does not affect hosted platforms such as Shopify, Wix or Squarespace. For a quick answer, enter your site's address in the check at the top of this page. Most servers hide the PHP version from outside, so only your hosting control panel gives a definitive answer. We will look at it for you free of charge.
- Doesn't my hosting update PHP automatically?
- Most hosting providers apply fixes within the same PHP branch themselves. They will not move you off an old branch (7.4, 8.0, 8.1), though, and often charge for extended support. Upgrading to a newer version and fixing whatever breaks afterwards is left to you.
- What if the site does not run after the upgrade?
- That is why we start with a backup. If the site does not run on the new PHP and the fixes are beyond the scope of the service, we restore it to its original state and suggest what to do next. We never decide anything without your consent.
- Do you work outside the Czech Republic?
- Yes. All the work is done remotely, so it makes no difference where your site or hosting is. We communicate in English and work during Central European business hours.
- What access do you need?
- Access to your hosting control panel and to the site's admin. We exchange passwords securely, not by regular e-mail, and recommend changing them once we are done.
- How long does it take?
- A typical site on hosting with a control panel is usually done within one working day of receiving access. Older sites and custom applications depend on their scope, and we tell you the timeline up front.
- Is one update enough?
- For a while, yes. But new PHP versions come out every year and each is supported for only a few years. That is why we go straight to 8.3 or 8.4, and the report states how long your version will be supported.
Is my website affected?
Put your website address in the message. Within one working day we will tell you whether the flaw affects you and which service we recommend. The check is free and without obligation.