PHP2Shell and PHP update: bring your website to a secure PHP version.
On 21 October 2026 the PHP team closed critical vulnerabilities known as PHP2Shell. They allow attackers to execute code on the server without logging in. We check which PHP version your website actually uses, carry out the PHP update and test that everything works afterwards.
What we do for you
From a quick check to switching from PHP 7 to PHP 8.
- Checking the PHP version actually in use via the web server, not just on the command line
- Update to the patched version with your hosting provider, in Plesk or on your own server
- Switch from outdated versions (PHP 7.x, 8.0, 8.1) to PHP 8.4 or 8.5
- Compatibility test of CMS, shop, plugins, themes and custom code in a test copy
- Adapting outdated code that produces errors or warnings under PHP 8
- Searching for traces: unknown files, web shells, new administrator accounts, modified files
- Interim measures as recommended by the BSI if an update is not immediately possible
PHP2Shell: the key facts
| Vulnerabilities | CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2 (critical) |
| Consequence | Execution of program code on the web server, without logging in |
| Fixed in | PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (released on 21 October 2026) |
| PHP 7.4, 8.0, 8.1 | No official update from php.net, only backported packages from individual Linux distributions |
| PHP 5.x to 7.3 | No update, switch to a current version required |
| Situation | First attacks observed, the BSI expects exploitation in the short term; no reliable workaround without an update is known |
As of 23 October 2026. Sources: php.net (supported versions), Deutschland sicher im Netz.
Prices and scope of services
Guide prices net, plus statutory VAT. The fixed price in our written quote is binding.
| PHP2Shell quick check with update Check the PHP version via the web server, update to a patched version, search for traces, short report | €149–349 |
| Switch from PHP 7.x, 8.0 or 8.1 to PHP 8.4 or 8.5 Test copy, compatibility check, adapting extensions, switchover, final check | €390–1,500 |
| Adapting custom code Replace deprecated functions, fix errors and warnings under PHP 8 | €45–60 / hour |
| Website care with ongoing updates Keep PHP, CMS and extensions up to date, backup, audit report | from €99 / month |
Why the update is worth it
Our approach
- CheckRecord version, system and extensions.
- Back upFull backup of files and database.
- TestNew PHP version in a test copy.
- Switch overLive switchover, coordinated with you.
- CheckFunctional test and report.
Frequently asked questions
How do I find out which PHP version my website uses?
In WordPress under Tools, Site Health, Info, Server. In Plesk in the domain's hosting settings. Note: the command line often shows a different version from the one the website actually runs on. We check the version directly via the web server.
Is it enough to update WordPress or the shop?
No. PHP2Shell sits in PHP itself, not in the CMS. That is why the PHP version on the server has to be updated. Updates to the CMS and plugins still remain important.
My hosting provider says they have updated. Does that make me safe?
For the server packages, usually yes. You should still check whether your website really uses the new version, because several PHP versions often run side by side on one server. And: anyone who got in before the update stays in the system afterwards. That is why we also search for traces of an attack.
My website still runs on PHP 7. What now?
Then a switch to PHP 8.4 or 8.5 is necessary. Older software does not always run there without adjustments. We test your website in a copy with the new version, adapt code and extensions, and only then switch over.
What does a PHP update cost?
The PHP2Shell quick check with an update to a current PHP 8 version costs €149–349 net. The switch from PHP 7.x, 8.0 or 8.1 to PHP 8.4 or 8.5 with compatibility testing costs €390–1,500, depending on the size of the website and the custom code.
Have your PHP version checked
Tell us your website address and, if known, the hosting provider and system. We will get back to you quickly with an assessment.
By phone: 030 417 17370
Briefly describe what you have in mind. We will get back to you with a concrete assessment.
Danziger Straße 78a
10405 Berlin
Berlin-Prenzlauer Berg