SafeHivePHP2Shell: is your server actually patched?
Two critical flaws in the PHP core let a stranger run code on your web server, no password needed. Patches came out on October 21, and exploitation attempts have been seen since that same day. If your site runs on PHP (WordPress, Drupal, Laravel, PrestaShop, Magento, a custom application), it is affected.
Who needs to act now
You run your own server
A VPS, a dedicated server, a machine at the office, a server set up by a former provider. Nobody will update it for you. This is the most exposed case.
Your site runs on an old PHP
PHP 7.4, 8.0 and 8.1 will not get a patched release. The fix is either a backported patch compiled from source or a move to 8.2 or later, which often means adjusting the site.
You patched after October 21
Patching closes the door, it does not remove someone who already got in. A malicious file dropped before the patch stays in place.
On shared hosting (cPanel at a large host)? Your host has most likely patched already. Ask them for written confirmation: it costs nothing and may be all you need.
Quebec Law 25: if an intrusion exposed personal information (customers, patients, employees), it is a confidentiality incident. It must be entered in your incident register, and reported to the Commission d'accès à l'information and to the people affected if it presents a risk of serious injury.
What we do for you
Fixed prices, per server, run from Laval. Nothing is touched on your server without your written authorization.
Exposure check
- A look at what your site shows publicly: advertised PHP version, web server
- Answer within 1 business day: exposed, probably patched, or impossible to tell from outside
- No intrusive testing
PHP2Shell remediation
- Update to the patched release and restart of every PHP process
- Compromise check: PHP files added or modified since October 20, suspicious web scripts, access logs
- PDF attestation: versions before and after, findings, date and time
- For PHP 8.2 to 8.5 with SSH or control panel access
End-of-life PHP (7.4, 8.0, 8.1)
- Backported patch compiled from source, or migration to PHP 8.2 or later
- Everything in the remediation
- Fixed price confirmed in writing after a first look, before any work starts
This service is not a penetration test. A compromise check reduces risk and documents what was verified; it cannot prove that no intrusion took place. If we find signs of intrusion, we tell you right away and walk you through the options before going further.
Prefer to do it yourself?
Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply your Linux distribution's security update. Then restart every PHP process (PHP-FPM, Apache). If you cannot update right away, cut the server's Internet access or restrict it to known addresses. According to the PHP team, no configuration setting replaces the update.
To know which version is really running, php -v is not always enough: the web server may use a different installation. A temporary phpinfo() page, deleted right after, shows the version and mode (FPM or Apache module) the site actually uses.