Critical PHP flaw: we patch your servers, starting
within 24 hours
Two flaws in the PHP core let attackers run code on your server without logging in, and first attacks are being reported. If your team is short on time right now: our developers update PHP, rebuild your images and then check from the outside that the hole is closed.
Free quick check
Which PHP version does your website reveal?
We load your start page once, like a browser does, and read what the server says about PHP. No sign-up, no data from you.
A quick check, not a security test: it only sees what the server chooses to reveal. "Patched" or "not found" is no proof that your systems are safe.
The patch is out. What matters now is who applies it today.
On October 21, 2026 the PHP team fixed two critical flaws (CVSS 9.2). The details had leaked beforehand, and security researchers expect automated attacks on everything not yet updated. A plugin update does not help; PHP itself has to be patched, on every server and in every container image. That is exactly the time many teams do not have right now. Our developers take it on: we find out where PHP runs, apply the update, set the PHP team's interim mitigations where an update is not possible yet, and then check from the outside that the hole is really closed.
All the facts about the flaws, updated as news comes in: PHP2Shell: what to do right now →
What we take care of
From the first overview to proof that the hole is closed
How patch help works
Short, documented, with proof at the end
Request and call back
Tell us which systems are affected. We get back to you the same working day and agree scope, access and effort in 15 minutes.
Quote and sign-off
You get a short written quote based on effort. With your sign-off we fix the system list, maintenance window and contact person. You give us time-limited access, which you revoke afterwards.
Patching
Within 24 hours of sign-off we start: update PHP, rebuild images, restart workers. Where that is not possible right away, we set the interim mitigations.
Checking
We verify the running version in a real web request and from the outside. If we find signs of a compromise, we stop and tell you immediately.
Proof
You get short documentation: which systems, which version before and after, which measures are still open. Useful for your NIS2 or customer evidence too.
What patch help is — and what it is not
We help you fix things fast. For a breach you need other specialists, and we say so openly.
Included
- PHP update to the fixed release, on Linux servers, VMs and in container images
- The PHP team's interim mitigations where an update is not possible yet
- Restart of all PHP processes and a check in a real web request
- Outside check after the patch
- Short documentation as proof
Not included
- Forensics and incident response after a breach — we recommend a specialised IR provider
- Round-the-clock standby: we work on working days
- Shared hosting and appliances: the provider patches there, we help you ask the right questions
- Larger code changes for a PHP upgrade — a separate offer after a check
Each week we only accept as many patch jobs as we can start within 24 hours. If we are full, we tell you when you get in touch, before you order anything.
Why us
Developers who run PHP systems every day, plus a security team that checks
Fast, even overnight
Our team works in Germany and Vietnam. What you sign off in the evening can be done by the next morning.
Nothing starts without your okay
Every environment is different. So we estimate the effort upfront and only start once you have agreed. Extra work only after you agree.
Checked, not just installed
An update is only done when the running version is right. We check from the inside and the outside.
Honest about the limits
If we find signs of a breach, we tell you immediately and recommend who can help, instead of carrying on ourselves.
Patch help FAQ
What customers want to know before patching
Every system running a PHP version below 8.2.35, 8.3.36, 8.4.27 or 8.5.12 is affected, as is everything on PHP 8.1 or older unless a backport has been applied. Servers with Apache and mod_php are the most urgent. Our quick check above shows what your website reveals; only a look at the server gives a reliable answer.
Do not leave the hole open over the weekend
Tell us which systems are affected. We get back to you the same working day and estimate the effort before we start.