In short: Affected? Call us. We help. If you have an IT emergency on your web server and no expert at hand, you can hire us with one message: we take over from the first message, work remotely with no travel and put everything in writing until the incident is closed and documented.
Do not delete anything and do not rebuild anything right now. Not even as preparation for the service provider. The state of the system is the most important piece of evidence. Report an emergency and we will clarify access and roles together.
Are You Affected? When You Need an Emergency Service Provider
Not every disruption is a security incident. An emergency service provider makes sense if at least one of these points applies:
- Your web server is behaving oddly and nobody in-house can identify the cause.
- There is a suspicion of malicious code, a break-in or leaked data.
- The host has blocked the service or demands a cleanup.
- Your PHP version is old or unclear, and you do not know whether the PHP2Shell vulnerabilities were exploited.
- Your own IT team or the agency is unreachable or has no experience with incidents.
The suspicion is enough. Whether you can make progress yourself or need support can be weighed using the page Fix it yourself or call a provider?.
What to Do Right Now
- Freeze the state. No changes to the server, no cleanup actions, no blind updates.
- List the access details. What panel, SSH, CMS and database access exists, and who manages it?
- Inform the host. Ask it to preserve logs and snapshots. Withhold nothing that it needs to know.
- Set the decision maker. Who in the company approves shutdowns, restarts and password changes?
- Clarify the data situation. Is personal data, payment data or trade secrets stored on the system?
- Inform those involved. The data protection officer and, if you have one, the cyber insurer.
- Hire the service provider. Call us or write to us on WhatsApp. We take over from the first message.
How Hiring Works
An emergency cannot tolerate a long contract process, but it cannot tolerate gaps in responsibility and data protection either. That is why we proceed in this order:
- Initial call: We listen to the situation and ask the few questions needed for a first assessment.
- Agree the framework: Together we clarify which systems we may examine, who decides and how we communicate.
- Settle data protection: If we access systems containing personal data, we discuss the necessary data processing agreement. The basics are explained on the page Data processing when accessing servers.
- Set up access: You give us only the rights needed for the assignment. After completion, access is withdrawn again.
- Work and reports: We report with interim statuses and put the results in writing.
How to compare providers in general is covered in Choosing an IT security provider: 12 questions. Contractual obligations around security are covered in Service provider contracts: clearly regulating security duties.
How Does PHP SOS Help?
- Assess the situation: What happened, which servers are running, which PHP versions and which operating mode (PHP-FPM, mod_php, LiteSpeed) are in use?
- Secure and close: We secure logs, files and database. Then we fix the cause: patch, configuration or blocking access, with a restart of all PHP processes.
- Check and clean up: We look for webshells, backdoors, cron jobs and foreign access and remove them, or rebuild from clean sources.
- Harden and report: You receive a report with a timeline, findings and recommendations. For larger incidents we move into incident response.
If it is initially only about the PHP vulnerability and proof of the patch, the PHP2Shell emergency response for companies fits. If malicious code is present, malware removal is the right starting point.
How to Recognize a Reputable Emergency Service Provider
In an emergency many people reach for the first provider they find. Three questions help to create order within minutes. First: is evidence secured first and only then changed? Anyone who "tidies up" immediately blocks later investigation. Second: is it recorded in writing what was found and done? Without documentation, neither insurers nor data protection officers can do anything with it. Third: are limits named? A provider who declares everything feasible before seeing the system should be treated with caution.
Also check whether the service provider understands your operating mode. PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed behave differently when patched, and after the update all processes must be restarted, otherwise the old state keeps running in memory.
What an Emergency Service Provider Cannot Do
It is worth knowing the limits in advance. No service provider can retroactively produce logs that were never written or have already been overwritten. Where traces are missing, we name the gaps openly. Nor can anyone promise that a cleaned system will never be attacked again. And legal advice is not part of our assignment: questions about reporting duties, liability and insurance go to the data protection officer, lawyer and insurer, and we supply them with the technical facts.
What You Should Send Us
- a short description of the incident and when it was noticed
- affected domains, servers and, as far as known, the PHP version
- the name of the host and the type of contract (shared hosting, virtual server, root server, managed server)
- a contact person with decision authority
- existing backups and their state
Why PHP SOS
We work Made in Germany and, together with our partner network of cyber professionals, have specialized in IT security for over 25 years. You talk to one fixed contact, we work remotely across Germany and Europe and document every step. We say openly what is proven and what is not, and we make no promises that no reputable service provider can give. Our order is always the same: secure first, then change, then report.
Affected? Call Us. We Help.
Do not keep searching for the right service provider while the incident is running. Call us or write to us on WhatsApp, and we take over from the first message. Report an emergency now.
Frequently asked questions
How do I recognize a good IT emergency service provider?
It preserves evidence before changing anything, openly separates what is proven from what is assumed, documents every step and promises no miracles. Be suspicious of statements like "guaranteed completely clean", because nobody can seriously promise that.
What access does a service provider need in an IT emergency?
As a rule, SSH or panel access to the server, access to the CMS back end and the database, or your permission to talk to the host. Give only what is necessary, and keep a record of who received which access and when.
Do I need a data processing agreement for remote access?
If a service provider accesses systems containing personal data, an arrangement on data processing is usually required. The assessment is made by the data protection officer or lawyers. We clarify this with you right at the start.
What is the difference between incident response and malware removal?
Malware removal cleans an infected system. Incident response is broader: it covers the situation picture, containment, cleanup, communication and follow-up, often across several systems.
Does my host have to be involved?
Often yes, for example for snapshots, logs or lifting blocks. We coordinate with your host if you allow it. What can be examined depends on the rights we are given.