# Server Hacked: What to Do? First Steps and Emergency Help > Server hacked, what to do? Delete nothing, preserve evidence, sort out access. We take over remotely. Call us or message us on WhatsApp. Source: https://phpsos.de/en/soforthilfe/server-gehackt-was-tun/ As of: 25/10/2026 Provider: PHP SOS, PHP emergency help and server security. Immediate help via WhatsApp: https://wa.me/491736494914?text=Hello%20PHP%20SOS%2C%20we%20need%20help%20with%20our%20PHP%20server.%20Company%3A%20%E2%80%A6%20Website%3A%20%E2%80%A6 **In short:** Affected? Call us. We help. If you suspect that your server was hacked, one thing counts first: preserve the evidence. From the first message we remotely handle the situation picture, securing, containment, cleanup and documentation until the incident is closed. > **Act now:** > **Do not delete anything and do not rebuild anything right now.** Do not restore a backup either before the evidence has been secured. Anyone who tidies up destroys exactly the traces that show how the attacker got in. [Report an emergency](https://phpsos.de/en/notfall/) and we will proceed together. ## Are You Affected? Signs That a Server Was Hacked A suspicion is enough to get in touch. You do not have to prove the attack. Typical clues are: - The web server or PHP-FPM starts processes such as `sh` or `bash`. This is a strong warning sign, which we explain on the page [The web server starts a shell](https://phpsos.de/en/blog/webserver-startet-shell/). - New or unknown PHP files are sitting in upload, cache or temp folders. - There are cron jobs that nobody created, or SSH keys that nobody can attribute. - The load is high for no apparent reason, or the server makes unusual outgoing connections. - Mail from your server lands in spam or is rejected. - Your host, a customer or a browser warning reports malicious code. - Administrator accounts appear in the CMS that nobody created. You will find more signs under [Am I already compromised?](https://phpsos.de/en/php2shell/bin-ich-gehackt-anzeichen/). If several of these points apply, treat the server as hacked until the opposite is proven. ## Server Hacked: What to Do Right Now 1. **Stay calm and change nothing.** No deleting files, no "quick fixes", no reinstalling over the old state. 2. **Record the time.** Note what you observed and when, and who last made changes to the system. 3. **Preserve the logs.** Access, error and system logs must not rotate or be overwritten. For PHP2Shell, trade press advises keeping server logs from 20 October 2026 onward. 4. **Reduce the attack surface.** Take the server off the public network or block it with a firewall if data could be leaking. Do not simply switch it off. 5. **Collect access details.** Who has SSH, panel, FTP, CMS and database access? Change passwords only after consultation and only from a clean device. 6. **Name a contact person.** A person with decision authority should be reachable, including for shutdowns and restarts. 7. **Get in touch now.** Call us or write to us on WhatsApp. We will clarify everything else with you step by step. ## Take It Offline or Let It Keep Running? This is the most common question in the first minutes, and it has no blanket answer. If an online shop with payments or a portal with customer data is running, protecting the data usually outweighs everything else. Then temporary isolation is right, for example via a maintenance page or a firewall rule that admits only your administrators. A hard shutdown, by contrast, is rarely the best first step, because there are traces in memory that a restart erases. It is better to take an image of the system, for example a snapshot at the host, before anything is changed. In the PHP2Shell situation, the BSI (German Federal Office for Information Security) recommends temporarily taking web servers offline if an update is not immediately possible. That does not mean that every server taken offline was hacked. Whether in your case you isolate, throttle or let it keep running, we decide with you based on what is on the system. ## Rebuild or Clean Up? Many people would like to rebuild the server immediately. That is not wrong, but only after securing the evidence. Otherwise it stays unclear how the attacker got in, and the same route is open to the new system as well. The trade-off is described on the page [Rebuild the server or clean it up?](https://phpsos.de/en/blog/neu-aufsetzen-oder-bereinigen/), and securing evidence before a rebuild on the page [Secure evidence before you reinstall](https://phpsos.de/en/blog/beweise-sichern-vor-neuinstallation/). Important: a PHP update alone does not solve the problem. It closes the vulnerability but does not remove malware that has already been planted. How to find traces in the logs is described under [Analyzing web server logs after an attack](https://phpsos.de/en/ratgeber/logfiles-auswerten/). And assume that credentials from configuration files were read as well: database, mail and API access belong on the list of secrets to be renewed. ## How Does PHP SOS Help? 1. **Assess the situation:** We clarify with you what was observed, which systems may be affected and which data is stored there. 2. **Secure and close:** We secure files, database and logs before anything is changed. Then we contain the attack and close the entry point, with PHP2Shell by patching and restarting all PHP processes. 3. **Check and clean up:** We look for webshells, backdoors, cron jobs and foreign access and remove them. Details are under [Having malware and webshells removed](https://phpsos.de/en/leistungen/malware-entfernung/). 4. **Harden and report:** You receive documentation with a timeline, findings and recommendations. If the incident extends beyond one server, we switch to structured [incident response](https://phpsos.de/en/leistungen/incident-response/). ## What You Should Not Do Avoidable mistakes happen under stress. Do not delete "suspicious" files on a hunch without having secured them first. Do not run commands from forums that you do not understand. And do not install security plugins on a server that may already be compromised: malicious code can fool scanners, and the result lulls you into false security. Be careful, too, with tips to block all requests with a particular session ID; expert authors expressly reject such advice for PHP2Shell. You can safely check your own version with `php -v` and a look at your distribution's package changelog, because backports often leave the version number unchanged. ## What You Should Send Us - a short description: what was noticed, since when, what was changed last - the type of system: own server, virtual server, managed server or hosting package - access via SSH or panel, or permission to talk to your host - details of existing backups and their age - warning messages from your host, browser or customers, verbatim If any of this is missing, get in touch anyway. We close the gaps in conversation. ## Why PHP SOS We work Made in Germany and, together with our partner network of cyber professionals, have specialized in IT security for over 25 years. You have one contact; we work remotely, with no travel, across Germany and Europe. Every step is documented, and we openly separate what is proven, what is probable and what is unknown. We make no promises that nobody can keep. An overview of the follow-up is in the [checklist after a hack](https://phpsos.de/en/ratgeber/checkliste-nach-dem-hack/), and the full emergency service under [Website hacked? Remote emergency help](https://phpsos.de/en/leistungen/website-gehackt-notfallhilfe/). For the reporting duty in case of data breaches, read the [72-hour rule](https://phpsos.de/en/compliance/dsgvo-meldepflicht-72-stunden/); the legal assessment remains with data protection officers and lawyers. ## Affected? Call Us. We Help. Do not wait until the suspicion turns into greater damage. We take over from the first message and stay with you until the incident is closed and documented. [Report an emergency now](https://phpsos.de/en/notfall/). ## Frequently asked questions **Server hacked: should I switch it off immediately?** Not in haste. Switching off can destroy volatile traces in memory. It is better to disconnect the server from the network or isolate it with a firewall and secure it first. If you are unsure, contact us beforehand. **How do I find out whether my server was really hacked?** Clues come from processes started by the web server, new PHP files in upload or cache folders, unknown cron jobs and SSH keys, and unusual outgoing connections. Only an analysis of the logs and files gives certainty. There are no confirmed PHP2Shell indicators; detection relies on behavioral analysis. **Is a PHP update enough if the server has already been hacked?** No. A patch closes the entry point but does not remove malware that has already been planted and does not prove that nothing happened beforehand. After the update, all PHP processes must also be restarted. **Do I have to report a hacked server?** If personal data may be affected, a notification to the supervisory authority within 72 hours may be required. Your data protection officer or your lawyer makes that assessment; we supply the technical facts for it. **Can I clean up the hacked server myself?** On small systems it is possible but risky: anyone who removes only visible files often overlooks backdoors, cron jobs or access. We check whether a cleanup is enough or whether a rebuild from clean sources makes more sense. ## Sources - [BSI: German Federal Office for Information Security](https://www.bsi.bund.de/) - [GDPR Art. 33: notification of the supervisory authority](https://dsgvo-gesetz.de/art-33-dsgvo/) - [OWASP Cheat Sheets](https://cheatsheetseries.owasp.org/)