Start by checking your website’s PHP setup.
PHP is the software that runs many popular websites. A PHP security issue can require action from your hosting provider or whoever manages your server, as well as attention to the website itself.
Hearing about the PHP2Shell vulnerabilities does not mean your website has been hacked. Whether it needs a particular update or protective change depends on the PHP version and settings actually used by your site.
What has the PHP team announced?
In its 20 October notice, the PHP security team announced an update addressing two critical vulnerabilities, scheduled for 21 October 2026. It said the affected and fixed versions would be published with the release.
Check the official notice and ask your host which update or protective action applies to your website. We do not list affected versions here unless they have been confirmed by the PHP team.
Read the official PHP security notice ↗
Three useful questions to ask your host.
- Which PHP version is my website using? A server can have several versions installed, so the check needs to cover the version your website actually uses.
- Have the relevant updates or protective changes been applied? Ask what changed and whether your website was checked afterward.
- Is there any reason to investigate a possible hack? Applying protection does not remove malware that may already be present.
We can handle the checks and explain the results.
With the $149 PHP Security Check, we review your PHP setup, adjust security settings where needed, and check your website afterward. You receive a written summary of the work and anything that still needs attention.
The $349 Security Check + Investigation also includes up to two hours looking through relevant files and available activity logs for signs of a hack. Confirmed malware cleanup is separately quoted, starting from $499 additional.
A protective settings change may reduce a particular risk, but it does not replace an official PHP security update. We explain any remaining updates, including work that needs a separate quote.
If your website is behaving unusually.
Unexpected redirects, unfamiliar files, or warnings from your host are reasons to ask for help. Tell us what you noticed and when. If an attack appears to be ongoing, contact your host about restricting access and preserving available records.
Avoid deleting suspicious files or reinstalling the website before an investigation plan is agreed, as this can remove useful evidence. Please keep passwords, private keys, and customer information out of your first message to us.
What a review can tell you.
We explain what we checked and what the evidence shows. If older records are missing or a question needs a deeper investigation, we say so. A targeted review cannot guarantee that a website has never been hacked.
Sources: PHP security notice and PHP supported versions. This page is a dated guide; check the official sources for later updates.