Patch Your PHP Server Before Attackers Find It
PHP Security Patch and Exposure Check
Critical PHP flaws can let attackers run code on a server with no login. We check the real PHP version, patch where we can, harden risky settings, and look for signs of a breach.
PHP Security Patch and Exposure Check - Service Overview
A fixed-price check, patch and breach scan for your PHP server, covering up to 10 websites, so the critical PHP remote code execution flaws are closed and any damage is found early.
Two critical flaws were reported in PHP itself, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). They can let an attacker run code on a server that handles PHP requests, without logging in, and the attack happens before your website code runs. That means a well-built WordPress or custom site can still be exposed if the server underneath is not patched. Exploitation has been reported.
This service deals with the server layer. We first find the PHP that actually serves your websites, because the version shown on the command line is often a different one. Where we control the server and a fixed release exists, we update PHP and restart it. We then harden the risky settings and scan up to 10 websites on the server for common signs of a breach, such as web shells, changed files and unknown administrator accounts.
You receive a written report with every change, the result of the checks and what to do next.
What it does not cover
- No upstream fix: PHP 8.1 and older have no official fix. For those, an upgrade is the real solution, and it is a separate service charged separately.
- Shared hosting: only your host can patch the server PHP. We verify the exposure and give you instructions to send to them.
- Cleaning a breach: if we find one, recovery is a separate service.
Please note that a firewall helps but does not replace patching.
Finds the Real PHP
We check the version that serves your sites, not just the command line.
Patched And Hardened
Fixed release where we control the server, and safer settings.
Breach Check Included
Up to 10 websites scanned for web shells and changed files.
What's Included
Full PHP Server Security Checklist (20 Items)
How It Works
Place Your Order
Buy the service for each server. Tell us the server type, hosting provider and up to 10 website URLs. You receive a short list of the access we need.
Share Access and Exposure Check
You share server access securely. We find the PHP that actually serves your sites and confirm whether it is an affected version.
Patch and Harden
Where we control the server, we update PHP to the fixed release, restart it and harden risky settings. On shared hosting, we prepare instructions for your host.
Compromise Check
We scan up to 10 websites on the server for web shells, changed files, unknown admin users and unusual activity.
Report and Next Steps
You receive a written report with every change, the findings, and advice on upgrades, cleanup or further protection.
If your server runs PHP and the version is older than the fixed release for its branch, it is likely affected. The command-line version can differ from the one serving your websites, so we check the real one. Details are in the official PHP security advisories.
Yes. The flaws are in PHP itself, not in WordPress or any plugin. A fully updated WordPress site on an unpatched server can still be exposed, and the attack happens before WordPress loads.
Yes, at the same price. Only your host can patch PHP on shared hosting, so we verify the exposure, apply any settings you are allowed to change, and write instructions you can send to the provider.
Those versions have no upstream fix. We apply the interim mitigations we can and report the remaining risk. The real solution is upgrading PHP, which is a separate service charged separately. See our PHP Version Upgrade and Compatibility Fix.
One purchase covers one server, such as a VPS, dedicated server or cloud instance, and up to 10 websites on it. If you have several servers, order one for each. For more than 10 websites on a server, contact us.
PHP services need a restart, which can cause a brief interruption. We agree a suitable time with you first, and we keep copies of the configuration so any change can be reversed.
No. Patching closes the door but does not remove anything an attacker already left. Our breach check looks for common signs. If we find any, cleanup is a separate service, such as our Emergency Website Recovery.
A web application firewall can block some attack traffic and is worth having, but it does not replace patching. The published fix is in PHP itself, so the server should be updated.
Root or administrator access for a VPS or dedicated server, or access to your hosting panel. For shared hosting we need only enough access to check settings. Please share access only through the secure channel we send, never in the order note.
Most servers are completed within 1 to 2 working days of receiving access. Servers with many sites or limited access can take longer, and we tell you after the exposure check.
- This is a one-time service at a fixed price per server. One server means one VPS, dedicated server or cloud instance, and the price covers up to 10 websites hosted on it. Additional websites are quoted separately.
- We check the PHP version that actually serves your websites, which may differ from the command-line version. Where we control the server and PHP has a fixed release for your branch, we update PHP to the latest fixed release listed in the official PHP security advisories and restart the PHP services.
- Some PHP versions have no upstream fix, including PHP 8.1 and older. For these we apply the interim mitigations available, report the remaining risk, and recommend an upgrade. Upgrading PHP and fixing application compatibility is a separate service and is charged separately.
- Patching requires root or administrator access. On shared or managed hosting we cannot change the server PHP. In that case we verify the exposure, apply any settings you are allowed to change, and give you written instructions for your hosting provider. The price is the same.
- PHP services must be restarted, which can cause a brief interruption. We agree a suitable time with you first.
- The compromise check looks for common signs, such as web shells, recently modified PHP files, unexpected administrator accounts and unusual processes. It is not a full malware audit and does not guarantee that a site is clean. If a compromise is found, cleaning it is a separate service.
- Some hardening settings, such as turning off session upload progress, can affect specific features. We tell you what we changed and why.
- We take copies of the configuration files before changing them and record every change. If a change we made causes a problem and you report it within 7 days, we roll it back at no extra cost.
- A patch reduces risk from the published flaws. It does not protect against other vulnerabilities, and we cannot guarantee that no attack will succeed. Weaknesses inside your website code are outside this service.
- You provide server access through a secure channel. Delays caused by missing access do not count toward the delivery time. Refunds are not available once work has started.
- This service follows the master service agreement in place with Aarav Infotech, including confidentiality and data handling.
Related Services
You might also be interested in these services.
New
A one-time Cloudflare Pro WAF hardening service that inspects every request before it reaches your website, so inject...
New
A fixed-price check, patch and breach scan for your Node.js servers, covering up to 3 applications, so the critical B...