Services

Existing PHP Sites, Looked After

Takeover, migration, maintenance, rescue, upgrades and security fixes. Quietly.

Security Alert · Updated November 2026

php2shell is being exploited right now

On 21 October 2026 the US Cybersecurity and Infrastructure Security Agency (CISA) warned of two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619, known as “php2shell”. They let an attacker run code on your server without logging in. On 26 October CISA added both to its Known Exploited Vulnerabilities catalogue, meaning attacks are already happening.

Every PHP install that serves web pages is affected: Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. That covers almost every WordPress, Laravel and custom PHP site.

CISA's advice is to find every system running PHP, patch internet-facing ones first, and take a site offline if it can't be patched yet or runs PHP 8.1 or older. Sites on old versions can't simply be patched. They need an upgrade.

Read the CISA alert →

Fixed Releases

PHP 8.5.12 or later
PHP 8.4.27 or later
PHP 8.3.36 or later
PHP 8.2.35 or later

PHP Version Status

  • PHP 8.5Supported · Security fixes until 31 Dec 2029
  • PHP 8.4Supported · Security fixes until 31 Dec 2028
  • PHP 8.3Security fixes only · Until 31 Dec 2027
  • PHP 8.2Security fixes only · Ends 31 Dec 2026
  • PHP 8.1 and olderEnd of life · No fixes, including for php2shell
Check My Site

What We Do

Pick just the part you need

Each of these can be booked on its own. Most people start with one, often a rescue or a security fix, and add the rest later if it helps.

01

Takeover

Your developer has moved on, gone quiet or retired, and nobody knows how the site works.

  • -We get access sorted: hosting, domains, DNS, repositories, databases
  • -A written map of how the site is built and what it depends on
  • -Credentials rotated and old access removed
  • -A plain-English report of what needs doing now and what can wait
Ask about takeover →

02

Migration

Moving hosts, servers or stacks without losing data, rankings or email.

  • -Off ageing shared hosting, Plesk or cPanel onto a modern server
  • -Staged copy, tested before anything is switched over
  • -Redirects planned so search rankings carry across
  • -DNS cut-over timed for the quietest hour, with a rollback plan
Ask about migration →

03

Maintenance

Ongoing care so the site stays patched, backed up and working.

  • -PHP, framework, CMS and plugin updates tested before they go live
  • -Backups checked by actually restoring them
  • -Uptime, error and security monitoring
  • -A monthly retainer, or hours booked as you need them
Ask about maintenance →

04

Rescue

The site is down, hacked, blacklisted or throwing errors, and it needs fixing today.

  • -Triage first: get the site back up, or safely offline
  • -Malware and backdoor clean-up, then the hole that let it in closed
  • -Logs checked to find out what happened and when
  • -Help getting removed from Google and browser blacklists
Ask about rescue →

05

Upgrades

Moving old code onto a supported PHP version without breaking it.

  • -From PHP 5.x and 7.x through to 8.4 or 8.5
  • -Code scanned for removed functions and changed behaviour
  • -Laravel, Symfony, CodeIgniter, WordPress and hand-written PHP
  • -Tested on a staging copy before the live server is touched
Ask about upgrades →

06

Security Fixes

Known vulnerabilities found and fixed, starting with the ones being exploited now.

  • -PHP patched to a fixed release, including php2shell
  • -Audit of plugins, packages and Composer dependencies
  • -Server hardening: headers, file permissions, exposed files
  • -A short written summary you can pass to your insurer or board
Ask about security fixes →

Discreet by Default

Your site's problems stay between us

Nobody needs to know

We don't publish client names, add credit links or post case studies unless you ask us to. Happy to sign an NDA before we see anything.

No blame

Old code, a missing developer or a breach happens to good businesses. We fix it and tell you plainly what we found, without judging how it got there.

White label for agencies

If you're an agency with a client site in trouble, we can work under your name and report to you, not your client.

Your access, handled carefully

We use only the access the job needs, rotate credentials when we're done, and hand everything back documented.

Got a PHP site that worries you?

Email us the address and what's going on. You don't need to send any logins yet. We'll get back to you within one business day, and in confidence.

Get In Touch

[email protected]