PHP2Shell Audit & PHP Upgrade Service

Is Your PHP Site Vulnerable to PHP2Shell?

Because the flaws are in PHP, not in your application, a fully updated CMS on an unpatched PHP is still exposed. You may be affected if you run WordPress, Magento, Joomla, Drupal, a custom PHP application nobody has touched in years, or a site on a hosting plan you have not looked at since it was set up.

The version number alone does not always tell you. Some Linux distributions backport security fixes into older PHP versions without changing the version number. Ubuntu 22.04's PHP 8.1 package, for example, was fixed in 8.1.2-1ubuntu2.28. Shared hosts and managed platforms may patch for you, or may not have. If you are not sure, that is what a PHP security audit answers.

How to Check Whether Your PHP Is Patched

Run the command that matches your server. The fixed upstream versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

php -v

# Debian / Ubuntu
apt policy php8.1-common      # swap in your PHP version

# RHEL / Rocky / Alma
rpm -q php

# FreeBSD
pkg info -x php

Two traps: the command-line PHP can differ from the PHP your website actually uses, and distributions often fix older versions without changing the version number. Check your vendor's security notice, not just the number.

What unauthenticated remote code execution means

An attacker does not need an account or a password. They send a request to your server over the internet and get to run their own commands, with the same permissions as the web server or PHP process. In practice that can mean stolen customer data, malware planted on your site, defaced pages, or your server being used to attack other people.

What to do now

1. Update to a fixed version, or to your distribution's patched package, and restart PHP-FPM or Apache. The old code keeps running until you do.
2. If you are on PHP older than 8.2 with no vendor patch, upgrade PHP. Old code often breaks on a newer PHP, so test on a copy first.
3. Look for signs that someone got in before you patched: PHP files you do not recognize in web folders, recently modified files you did not change, unknown user accounts, and unexpected outbound connections.
4. If you find something, do not just delete it. Note what you found and when, and get help before you change more.

PHP Security Audit and Upgrade: What You Get

You receive a plain-English report: what was found, the risk level, what was fixed and what remains, plus a prioritized plan with costs for any remaining work. Optional ongoing support is available so the next security advisory does not catch you off guard. This sits alongside my other security and architecture consulting.

How a PHP2Shell Audit Engagement Works

Nothing is touched until you have approved the scope in writing, and every step is visible to you.

1. Free intro call (30 minutes). We talk through your systems, concerns and goals. No access needed.
2. Written scope and authorization. A short agreement listing exactly which systems I may access, what I may do, the dates, and a fixed fee. You sign before any work starts.
3. Access you control. You create a temporary account for me. I never ask for your passwords, and access starts read-only.
4. Assessment. I find the vulnerabilities and check for compromise. I do not change anything yet.
5. Findings review. I walk you through what I found, ranked by risk, with a fix plan and cost.
6. Fixes, with your approval. Changes happen only after you approve them.
7. Verification and offboarding. We confirm every fix is in place, then I remove all of my accounts and keys and confirm in writing.

My Commitments: Access, Data and Confidentiality

Your systems and data stay yours.

• Written authorization before I touch anything, limited to the agreed scope.
• I do not copy, download or keep your customer or business data.
• No testing that could harm production without your explicit approval.
• What I see stays between us. I will sign your NDA or provide mine.
• I keep a log of what I did and when, available to you on request.
• If I find signs of a breach, I tell you immediately and help you respond.
• If something is outside my expertise, I say so.

PHP2Shell Frequently Asked Questions

Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21, 2026, or a vendor package that backports the fix.

Is there a patch for PHP 7 or PHP 8.1?

Not from the PHP project: there is no upstream patch for versions older than 8.2. Some distributions backport fixes, such as Ubuntu 22.04's PHP 8.1 at 8.1.2-1ubuntu2.28. Without a vendor patch, the fix is to upgrade PHP.

Will upgrading PHP break my website?

It can, especially with old code. That is why upgrades are tested on a staging copy first where possible and scheduled around your business.

How do I know if my server was already compromised?

Common signs are PHP files you do not recognize in web folders, files modified when you made no changes, unknown user accounts and unexpected outbound connections. The compromise check in the audit looks for these.

How much does a PHP2Shell audit cost?

It is a fixed fee, agreed in writing before any work starts. The price depends on how many servers and sites you have, so request a quote and tell me what you run.

Do I need to give you my passwords?

No. You create a temporary account for me with read-only access to start, and I remove it when the work is done.

Who You Work With

Michael Marquez is a software engineer and former CTO with 35 years of hands-on experience in PHP, Perl, Java, Python and shell, on Linux and Windows servers running Apache, nginx and IIS. He has built and secured systems for Fortune 500 e-commerce, film post-production, military, mobile, and medical and financial platforms, and he wrote AI Is Not Your Architect. You work with him directly, not a junior team. Read more of his writing in Michael's Crumbs.