Unpatched PHP is an open door. We close it.
Remote emergency help for businesses in Europe: patching PHP, checking for signs of intrusion, removing malicious code, hardening servers. Immediately, with specialised partners, until the incident is closed and documented.
$ php -v PHP 8.3.35 (cli) (built: Sep 30 2026) ! State before the patch of 21 October 2026 $ phpsos pruefen --ziel produktion Operating mode ... php-fpm CVE-2026-109618 .. open CVE-2026-109619 .. open Worker restart ... pending $ phpsos absichern [ok] Package 8.3.36 applied [ok] all workers restarted [ok] File system checked for webshells [ok] Report for management created
- Made in GermanyIT security from Germany, working under European data protection law.
- Over 25 yearsSpecialised in IT security and server operations for over 25 years, together with our partner network.
- Partner networkSpecialised cyber professionals for forensics, penetration testing and server hardening, coordinated through one point of contact.
Are you affected? Call us. We will help.
Hacked, locked out, web shell found, or unsure whether PHP2Shell affects you: get in touch now. We take over from the first message, remotely and without travel.
Is your PHP already patched?
Enter your PHP version. The test compares it with the security announcements from php.net and tells you what to do next. Important: even a patched version does not prove that nothing happened before the update.
How urgent is your situation?
Four questions, a classification, the first steps and a prepared WhatsApp message to us. At level 3: delete nothing, rebuild nothing, preserve evidence.
From the emergency call to the hardened server
We take over the technology and deliver the evidence that management, data protection and insurance need.
PHP2Shell Emergency Help: Support With the PHP Vulnerability
We close PHP2Shell on your web servers remotely: inventory, patch or interim measure, restart of all workers and a written record.
Read more →02Website Hacked, What to Do? Remote Emergency Help
Is your website hacked or behaving oddly? We take over containment, evidence preservation, cleanup and documentation remotely.
Read more →03PHP Patch Service: Update Installed, With Restart and Proof
We install the PHP update on your servers, restart all PHP processes and deliver a written record of version, package state and restart.
Read more →04Server Hardening for PHP Web Servers
We harden your PHP web servers to a fixed plan: isolation per website, secure PHP configuration, file permissions, access, logs and backups.
Read more →05Having Malware and Webshells Removed From Your Website
We remove malicious code, webshells and backdoors from websites and servers, rebuild from trusted sources and close the entry point.
Read more →06Incident Response for Server Attacks
Structured incident handling for attacks on web servers: situation picture, containment, eradication, recovery and follow-up with fixed roles.
Read more →How we work in a real emergency
Clear steps, one point of contact, everything remote. Specialists from our partner network join when forensics or a pentest are needed.
Assess the situation
You write via WhatsApp or call. We clarify system, PHP version, host and observations.
Secure and close
Preserve evidence, patch PHP or put interim measures in place, restart all workers, document the patch level.
Check and clean up
Check files, database, accounts and logs for signs of intrusion. Remove webshells and back doors.
Harden and report
Harden the configuration, set up monitoring, report for management, data protection and insurance.
Can't patch yet? Interim measures
php.net names settings that make known attack routes harder until the update is applied. Choose your operating mode, copy the lines and then restart all PHP processes.
The BSI (German Federal Office for Information Security) recommends: if the update is not immediately possible, take the web server offline temporarily.
Interim measures according to php.net, no substitute for the update. memory_limit=-1 only together with a memory limit via container or cgroup. Back up the configuration first.
Who does what? The gap between host and agency
Many businesses rely on “someone” patching. As a rule, responsibility is distributed like this:
| Task | Host (shared hosting) | Agency / web design | PHP SOS |
|---|---|---|---|
| Update the PHP package | mostly yes | mostly not | yes, or with your host |
| Restart all workers and document it | partly | no | yes, with proof |
| Check whether a break-in occurred before the patch | usually not | partly | yes |
| Remove webshells and back doors | usually not | partly | yes |
| Report for management, data protection, insurance | no | rarely | yes |
| Hardening and ongoing monitoring | partly | partly | yes |
What is documented and what you do now
Facts from the announcements of php.net and the BSI, prepared for management and admins.
What Is PHP2Shell? The Vulnerability Explained Simply
PHP2Shell is a pair of critical vulnerabilities in PHP itself that let attackers execute code on web servers without logging in. The situation in plain words.
Read more →CVE-2026-109618: RCE via Out-of-Memory Condition
CVE-2026-109618 is one of the two PHP2Shell vulnerabilities: an out-of-memory condition can interrupt PHP in the middle of request processing. Fixed from PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Read more →CVE-2026-109619: RCE via Stale Global State
CVE-2026-109619 is the second PHP2Shell vulnerability: a request's internal state can persist after memory is freed and be used by the next request in the same worker.
Read more →CVE-2026-115560: Session Upload Progress Advisory
CVE-2026-115560 is an advisory from php.net dated 23 October 2026: possible code execution only with an unusual session configuration. Remedy until the next release: session.upload_progress.enabled=0.
Read more →Which PHP Versions Are Affected?
PHP2Shell is fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. There are no official updates for PHP 8.1 and older. The table shows the state per branch.
Read more →Checking the PHP Version and Patch Level Correctly
The displayed PHP version alone does not say whether PHP2Shell is closed. What matters are the package version, backports and whether the new processes are really running.
Read more →For your platform and your server
Where malicious code hides in WordPress, Shopware or TYPO3, and how to really patch on Plesk, cPanel or in a container.
Platforms
Server and hosting
Every industry has different data to lose
Health data, client confidentiality, payment data: we align the check and the report with your obligations.
10 steps before we take over
Tick off what is done. The list stays saved in your browser.
Ticks are stored only in your browser.
72 hours, NIS2, insurance
General guidance for management. Not legal advice.
GDPR Reporting Obligation: 72 Hours After the Incident
After an attack on a web server, a duty to notify the supervisory authority may apply. This page explains in general terms when the 72 hours start and what belongs in a report.
Read more →NIS2 and Web Server Security
NIS2 obliges many companies to carry out risk management and reporting. This page explains in general what that means for web servers and where to find reliable information.
Read more →Cyber Insurance: What Counts in a Claim
In an attack, early notice to the insurer, preserved evidence and coordinated steps often decide the payout. This page explains the typical points in general terms.
Read more →Liability of Management for IT Security Gaps
IT security is a management task. This page explains in general which duties of care apply and how managing directors can make decisions on vulnerabilities like PHP2Shell in a traceable way.
Read more →Expert articles for admins and developers
PHP2Shell timeline: chronology from 17 to 25 October 2026
All confirmed dates for PHP2Shell in one overview, from the first observed attack attempt to the status of 25 October 2026, and what follows from them for your checks.
Read more →Hosting provider PHP update confirmation: how to ask about patch status
After PHP2Shell, a displayed PHP version proves little. With this template you request a confirmation from your hosting provider that you can document.
Read more →Detecting and removing webshells
How to track down backdoors on PHP web servers without destroying evidence, and why deleting alone is rarely enough.
Read more →Finding a WordPress backdoor: tracking down backdoors systematically
Where backdoors typically hide in WordPress and how admins track them down systematically with WP-CLI and a few commands.
Read more →Configuring php.ini securely
Which php.ini settings reduce the attack surface, how to protect them against being overridden, and what additionally applies after PHP2Shell.
Read more →Using PHP disable_functions correctly
With disable_functions you block risky PHP functions. How to define the list to suit your application without taking the website down.
Read more →Situation, instructions, decision aids
From the BSI warning level through package changelogs to the question of whether to rebuild or clean up. Every article with sources.
PHP2Shell: What Is Confirmed and What Is Not
A fact check on PHP2Shell: which statements come from primary sources, which from media reports, and which claims do not hold up.
Read more →Changing the PHP Version in the Hosting Customer Area
How to switch the PHP version in your hosting provider's customer area, which version to choose and what to check before and afterwards.
Read more →Warning Sign: The Web Server Starts a Shell
If a PHP-FPM or web server process starts a shell, that is one of the strongest warning signs of a break-in. Here is how to check the process tree, classify exceptions and monitor the pattern permanently.
Read more →Isolating PHP-FPM Pools per Website
A separate pool per website is the beginning, not the end. Here is how to check existing pools and harden sockets, extensions, status pages, resources and logs.
Read more →Storing Passwords Securely in PHP: Using password_hash Correctly
How developers store passwords in PHP with password_hash and password_verify, choose the right algorithm and replace old MD5 or SHA-1 hashes without a password reset for all users.
Read more →IT Service Provider Contracts: Defining Security Obligations Clearly
PHP2Shell showed how often it is unclear who has to patch. Which security obligations belong in contracts with agencies, hosts and IT service providers.
Read more →The PHP programming language, explained clearly
How PHP generates a page, what SAPI, PHP-FPM and OPcache are and why exactly that decides security. Plus a glossary with all technical terms.
What is PHP2Shell?
PHP2Shell is the name for two critical vulnerabilities in PHP itself (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). They may allow attackers to execute malicious code on the server without logging in. Patches have been available since 21 October 2026.
Which PHP versions are safe?
The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Hosts and distributions sometimes apply backports without changing the version number. What matters is the package version or the provider's written confirmation.
Is a WordPress or shop update enough?
No. The vulnerability is in PHP, not in the CMS. A CMS update does not close it. And a PHP patch does not remove malicious code that was planted beforehand.
How quickly can you help?
We work remotely and start as soon as access is in place. Write to us via WhatsApp with your system, PHP version and observation. We will then clarify the approach directly.
Do you also work for agencies and hosting customers?
Yes. We work directly for businesses, in the background on behalf of agencies, and in coordination with your host if the host manages the server.
Do we have to report the incident?
If personal data may be affected, Art. 33 GDPR generally sets a reporting deadline of 72 hours from awareness. Whether it applies, you clarify with your data protection officer. We provide the technical documentation for it.
Every hour counts. Write to us now.
Briefly describe your system, PHP version and observation. We will get back to you, clarify the situation and work remotely until the incident is closed and documented.