Hire IT Security Experts Remotely: Call Us. We Help.

In short: If you need IT security experts for your web server and cannot or do not want to wait until someone is on site, we work remotely. If you are affected or unsure, get in touch now. We assess the situation, patch or clean up, harden the system and document everything, across Germany and Europe.

Are You Affected? When External Security Experts Make Sense

Not every company has an IT security department of its own, and even where one exists, there is often no time for an acute case. Outside help is appropriate if one of these points applies:

• Your server runs a PHP version whose patch status you cannot prove, and the situation around PHP2Shell makes you uncertain.
• There are signs of an attack: unknown PHP files, foreign admin accounts, redirects, warnings from your host or Google.
• Your administrator or agency is unreachable, overloaded or at the limit of their expertise.
• A patch cannot simply be applied because the application is old or the host is blocking.
• You must quickly demonstrate to management, insurer or customers what you have done.
• You simply do not know where to start.

The BSI (German Federal Office for Information Security) has issued warning level 3 (orange) for PHP2Shell and recommends updating immediately. According to the BSI, anyone who cannot patch immediately should take web servers offline temporarily. That is a moment when specialists pay off.

What to Do Right Now

1. Write the situation down in three sentences: What stands out, since when, which systems are affected?
2. Name the server and the responsible people: Where does the website run, who manages it, who has access?
3. Have the logs secured: Ask your host to keep logs from 20 October 2026 onward, as trade press advises.
4. Determine the PHP version: With php -v on the command line, in the hosting panel or through your host. Note that the command line can use a different PHP version than the web server.
5. No rash actions: No deleting, no reinstalling, no restoring a backup without securing it first.
6. Keep the decision maker reachable: We need one person who may decide on shutdowns, restarts and password changes.
7. Contact us: Call us or write to us on WhatsApp.

How Does PHP SOS Help?

1. Assess the situation: In the first conversation we clarify the occasion, systems, data types and responsibilities. You receive an assessment of what is urgent and what can wait.
2. Secure and close: We secure the state before we change anything, and close the acute access, for example through a patch, a restart of all PHP processes or interim measures.
3. Check and clean up: We look for traces of a compromise and remove malicious code. If the situation is unclear, read more about our approach under PHP2Shell emergency response.
4. Harden and report: We improve the configuration and deliver a report that third parties can follow as well. Recurring tasks such as updates are taken over on request by a security maintenance contract.

Working Remotely: What That Looks Like in Practice

Remote does not mean that we guess from a distance. We work on the system itself, just not in the same room. That saves travel and speeds up the start without reducing thoroughness.

Technically this usually runs through secured access, such as SSH with a key, or through your host's panel. We ask for access with the narrowest rights possible, valid only for the duration of the assignment. After completion you withdraw this access again, and we confirm which accounts and keys we had created.

If we access systems containing personal data, a data processing agreement is generally required. What to consider is described in Data processing when accessing servers. How to choose a suitable provider in general is explained in Choosing a security provider, and what belongs in a service provider contract in Service provider contract and security.

Even Without an Acute Incident: PHP Patch and Assessment

Not every call comes from an emergency. Many companies simply want to know whether they are affected and to have the update applied cleanly, with a restart and proof. The PHP patch service helps here. Important: an update does not prove that nothing happened beforehand, and does not remove malware that has already been planted. That is why we additionally check for traces when needed.

With distributions and hosts, the displayed version number sometimes still shows an older state even though backports have been applied. What matters is the package state and the provider's confirmation, not the number alone.

What You Should Send Us

• a short description of the occasion
• details of the hosting: own server, managed server, shared hosting, container
• the name of the host and, if there is one, the agency or administrator
• the known PHP version and the CMS or shop system in use
• whether personal data is processed
• a contact person with decision authority

Why PHP SOS

We work Made in Germany and, together with our partner network of cyber professionals, have specialized in IT security for over 25 years. You get one fixed contact who knows your situation, and traceable documentation. We work remotely, with no travel, and make no promises that nobody can keep. We separate statements cleanly into proven, probable and unknown.

Affected? Call Us. We Help.

If you need experts who start right away without anyone having to travel, get in touch now. Call us or write to us on WhatsApp. We take over from the first message and stay with you until the incident is closed and documented. Report an emergency now

Frequently asked questions

Sources

• BSI: German Federal Office for Information Security
• php.net: announcements and security updates
• BSI IT-Grundschutz (IT baseline protection)