Emergency PHP upgrade to stop PHP2Shell.

Why this can’t wait

Most hacks need a weak password or an outdated plugin. This one doesn’t. PHP2Shell is a flaw in PHP, the language your site runs on, so a fully updated WordPress site with every security plugin installed is still wide open if the server’s PHP is not patched. The attack runs before WordPress even loads, which is why firewalls inside WordPress cannot see it.

• October 17, 2026: Amazon’s threat intelligence records an exploitation attempt, four days before anyone could patch.
• October 21, 2026: PHP releases the fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 7.4, 8.0 and 8.1 get no official release, and 7.3 and older get no fix at all.
• Since then: exploitation reported in the wild, working exploit code circulating, and automated scanners sweeping the internet for unpatched PHP.

Once an attacker’s code is running on your server, they can read your database password, plant backdoors, redirect your visitors to scams and get your domain blacklisted. The cleanup after that costs far more than the patch. The full background is in my guide, PHP2Shell explained.

What the $195 covers

1. Find the PHP your site really runs. Not what the command line says, and not what the host’s plan page says: the build serving your web pages, including backported vendor builds that keep an old version number.
2. Back up first. Files and database, before anything changes.
3. Upgrade to a patched build. The smallest safe jump: a patch release on your current branch where possible, or a move to a supported branch if yours has no fix.
4. Restart every PHP worker. PHP-FPM, Apache, LiteSpeed, every version on the server. A patch that isn’t loaded protects nothing.
5. Test the site. Admin login, forms, checkout and error logs, with plugin and theme fixes if a branch change needs them.
6. Check for signs someone already got in. New PHP files, unknown admins, cron jobs, modified .htaccess files and other backdoors since October 17.
7. Written report. What you were running, what I changed, what I checked, and anything that needs your attention.

Order the $195 PHP2Shell upgrade →

Who needs this

Anyone whose website runs on PHP: WordPress, WooCommerce, Joomla, Drupal, Magento, PrestaShop, OpenCart, Laravel and custom PHP sites, on shared hosting, cPanel, Plesk, a VPS or a dedicated server. If you are not sure whether your PHP is patched, assume it isn’t until someone has checked. You can check it yourself with my guide on how to tell if you’re vulnerable, or upgrade it yourself with my step-by-step upgrade guide.

How it works

Order with the button on this page and pay securely through Stripe. I’ll then ask for hosting or server access through my secure client portal, never by plain email. I’m doing a lot of these right now, but same-day service is still likely, and I’ll keep you posted as I go. If I find that your site was already compromised, I’ll show you the evidence and you decide whether to go on to a full Bulletproof Cleaning. Nothing extra starts without your go-ahead. Worried you may already be hacked? Read the signs of a PHP2Shell compromise.

Common questions

What exactly do I get for $195?

I confirm which PHP build your site actually serves, take a backup, upgrade to a release that contains the PHP2Shell fix (or a vendor build confirmed to include it), restart every PHP worker, test your site, check for signs of compromise since October 17, 2026, and send you a written report.

How fast will it be done?

I’m doing a lot of these right now, but same-day service is still likely. You can order instantly, and I work through jobs in the order they come in. Your access details go through my secure client portal, not email.

Is the price per site or per server?

Per server or hosting account. If several sites share the same hosting account and PHP setup, one upgrade covers them. Separate servers or separate hosting accounts are separate jobs.

What if my site was already hacked?

I’ll tell you, with the evidence. Patching stops new attacks but does not remove a backdoor that is already there. If I find signs of compromise, you can choose a full Bulletproof Cleaning, and I will not start anything extra without your go-ahead.

What if my host will not let me upgrade PHP?

On some shared hosting the host controls PHP. In that case I check what the host offers, move your site to the newest patched build available, and tell you plainly if the host has no patched build so you can decide what to do next.

Will the upgrade break my site?

A patch release on the same PHP branch almost never breaks anything. If your site has to move to a newer branch because its current one has no fix, I test it and fix the plugin or theme problems that come up. The backup I take first means nothing is lost.