PHP2Shell: the PHP security release of 21 October

PHP security, fixed and signed off

We patch PHP servers, get written answers out of hosts, check exposed servers for a break-in and move old sites onto a supported PHP. Fixed prices, and a dated sign-off of what we did and how we checked it.

  • Fixed prices from £195
  • Dated written sign-off
  • Upgrades rehearsed on staging
  • Based in London

Start here

Which one do you need?

It depends on who runs the server your site is on.

Your host runs the server

Shared or managed hosting. The host has to patch PHP; we make sure they have and get it in writing.

Host and PHP confirmation, £195

You run the server

A VPS, dedicated or cloud server. Nobody else will patch it. We do, and prove it.

Patch and verify, £450

Your site needs old PHP

Stuck on PHP 8.1 or older because something breaks on newer versions. There is no official fix; the answer is an upgrade.

Upgrade to PHP 8.4, from £795

Fix it now

PHP2Shell response

For servers and sites exposed since 20 October. Each job ends with a dated sign-off.

Host and PHP confirmation

£195

2 working days

For sites on hosting you don't manage. We find out which PHP serves your site, who is responsible for patching it, and whether they have.

  • The PHP version and handler that actually serves your site
  • Your host's statement, read and checked against what PHP published
  • Written confirmation from the host that PHP was updated and restarted, not just shielded
  • A dated one-page sign-off for your records, insurer or Cyber Essentials file
  • If the host won't confirm: a written finding and the next step

Patch and verify

£450per server

Done within 2 working days

For servers you run yourself: a VPS, dedicated or cloud server, or a hosting account with shell access. We fix it and prove it.

  • Every PHP on the machine found: web, command line and containers
  • The fixed package installed, or your vendor's backport confirmed from its changelog
  • The right restart for your setup (PHP-FPM, Apache mod_php, LiteSpeed, Docker)
  • The running process checked, not the version banner
  • Any temporary workaround undone so the server behaves normally
  • A dated written sign-off of what changed and how it was verified

Patch and verify, priority

£750per server

Work starts within 4 working hours

The same job, started the same working day. We take up to two priority jobs a day.

  • Everything in Patch and verify
  • Work starts within 4 working hours of booking and access
  • Additional servers in the same job: £250 each

Compromise check

£850per server or site

3 working days

A server that was exposed from 20 October can't be called clean from its logs alone. We look for the signs of a break-in and tell you what we found.

  • New or changed files in web and temporary folders, PHP files in uploads
  • New admin users, scheduled tasks, SSH keys and database users
  • Unexpected processes and outbound connections
  • A list of passwords and keys to rotate
  • A written report; if we find a compromise, a fixed quote for the clean-up
  • Booked with Patch and verify: £1,100 for both

When our standard queue is over two working days, Patch and verify moves to £575, priority to £950 and each extra server to £325, and back when it clears. Booked jobs never change price.

Get off old PHP

PHP upgrades

PHP 8.1 and older got no fix for PHP2Shell, and PHP 8.2's security support ends on 31 December 2026. We move sites straight to PHP 8.4, rehearsed on a staging copy first.

PHP 8.2 to 8.4

£495

5 working days

For sites already on PHP 8.2 or 8.3. PHP 8.2's security support ends on 31 December 2026.

  • Compatibility check on a staging copy
  • Fixes for anything that breaks
  • Rollback plan, live switch and 14 days of fixes after

WordPress site upgrade to PHP 8.4

£795

5 working days

One WordPress site on PHP 8.1 or older, with off-the-shelf plugins and theme.

  • Every plugin and the theme checked against PHP 8.4
  • Abandoned plugins patched or replaced
  • Staging copy, rollback plan, live switch
  • 14 days of fixes after go-live

Complex upgrade

£1,950

10 working days

WooCommerce shops, custom themes and plugins, or a bespoke PHP application up to about two days of work.

  • Everything in the WordPress upgrade
  • Custom code brought up to PHP 8.4
  • Checkout and integrations tested on staging

Legacy application

From £4,500

Scoped first

Magento 2.4.4 or 2.4.5, Drupal 7, Joomla 3 and older custom systems. A paid scoping day (£900, credited against the work) comes first, then a fixed quote.

  • Scoping day: £900, credited if you go ahead
  • A fixed price and timeline before any build starts

A brochure site that would cost more to upgrade than to replace may be better rebuilt: a new site in 10 working days, £1,999, with no PHP to patch again.

Keep it fixed

Patch Watch

PHP2Shell won't be the last critical release. Patch Watch warns you when one is coming, keeps PHP and the platform current, and proves it every month. Every release we're tracking

Patch Watch: site

£99a month per site

Set up within 5 working days

For a site on managed hosting or a platform. We watch its PHP or Node.js, its platform and its end-of-life dates, and keep it current.

  • Advance warning when PHP, Node.js, OpenSSL or your platform pre-announce a security release
  • Critical security updates applied within 14 days of release, with dated evidence
  • End-of-life tracking, with upgrades planned before support runs out
  • Monthly backup check and report
  • Email support in UK working hours

Patch Watch: server

£249a month per server

Set up within 5 working days

For a server or container host you own. We keep its operating system, PHP or Node.js patched and prove it each month.

  • Advance warning of pre-announced security releases, and whether you run an affected version, before release day
  • Operating system, PHP and Node.js updates, restarts and redeploys verified
  • Critical security updates applied within 14 days of release, with dated evidence
  • Monthly backup restore test and report
  • Email support in UK working hours

For agencies and freelancers

Agency portfolio triage

For agencies and freelancers with many client sites: the PHP version, host and who patches each one, chased with the hosts and returned as one dated status sheet. White-label, and batches of patch-and-verify jobs at 20% off.

£75a site, minimum 10 sites

2 working days from receiving the list

All prices are fixed, excluding VAT, and agreed in writing before any work starts.

How it works

From first message to signed off

  1. 01

    Tell us about the site

    The address, where it's hosted and anything you already know. The free check is a good start.

  2. 02

    Fixed price, in writing

    We confirm the job, the price and the turnaround before any work starts.

  3. 03

    Access just for us

    A separate account or key, never your own password, removed when we're done.

  4. 04

    Fixed, checked, signed off

    We do the work, verify it on the running server and send the dated sign-off.

Questions

Before you book

How do you get into my server, and what happens to that access afterwards?

We ask for a separate account or SSH key just for us, never your own password, and we tell you exactly what we'll change before we change it. When the job is signed off you remove our access, and we confirm in writing that we've deleted any keys we held.

What if the update breaks something?

Before touching a live server we take a snapshot or backup where the platform allows it, and every upgrade is rehearsed on a staging copy first. If something breaks, we roll back and fix it within the job's price.

What's in the written sign-off?

The date, the server, the PHP packages before and after, how the fix was confirmed (the package changelog, the restart, the running process) and anything we recommend next. It's written for your records, your insurer or your Cyber Essentials assessor.

What if you find my server has been compromised?

We stop, tell you straight away, preserve the evidence and give you a fixed quote for the clean-up or rebuild. Where personal or payment data may be involved we'll also point you to an NCSC-assured incident response provider, because that's the NCSC's advice and we're not one.

What are your working hours?

09:00 to 17:30 UK time, Monday to Friday. Turnaround times count working hours and days. We don't sell 24/7 cover we can't staff; if your situation needs it, we'll tell you who does.

Why do patch prices sometimes change?

When our standard queue is more than two working days long, Patch and verify moves to £575, priority to £950 and each extra server to £325. It moves back once the queue is a day or less. A price we've quoted holds for 48 hours, and a job you've booked never changes price.

Do you work outside the UK?

We work with businesses in the UK and Ireland, and take on work from elsewhere in Europe and North America on request. Prices are for business customers.

Not sure where you stand?

Run the free check, or send us the address and where it's hosted. We'll tell you which job you need, if any, and what it costs.