Skip to content
SocialNow

Free security scan

Is your website safe?

How and what we measure.

  1. NintendoDexerto(opens in a new tab)
  2. WikipediaMashable(opens in a new tab)Wikipedia, PHP2Shell(opens in a new tab)
  3. Germany, ITZBundMashable(opens in a new tab)
  4. Finland, ValtoriMashable(opens in a new tab)
  5. Belgium, Foreign AffairsMashable(opens in a new tab)
  6. The Netherlands, Overheid.nlMashable(opens in a new tab)Wikipedia, PHP2Shell(opens in a new tab)
  7. W3Techs, usage of server-side languages, August 2026. w3techs.com(opens in a new tab)

Talk to Steef or Michelle.

Plan an in-depth conversation or claim the free update of your current systems. Because this affects all of us, we're temporarily doing the essential updates for free.

What you can do right now.

  1. Ask your hosting provider whether PHP has been updated to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer, or to their package with the backported fix. Ask for written confirmation.
  2. Do you manage the server yourself? Update PHP through your package manager (apt or dnf) and then restart PHP-FPM or Apache. Otherwise the old version simply keeps running.
  3. Running PHP 8.1 or older? There may be no fix for it. Choose a newer PHP version in your hosting panel (hPanel, cPanel or Plesk) and test your site afterwards.
  4. Can't update right away? Take your site offline or put it in maintenance mode for now. The NSA and the UK NCSC advise the same.2,3
  5. Also check your other sites and subdomains on the same hosting. Each site can run a different PHP version.
  6. After updating: look for unknown admin accounts or new files, change your passwords and make sure you have a recent backup stored off the server.
  7. Also update your CMS, plugins and themes, and remove what you don't use. That's good maintenance, but it doesn't fix the PHP flaw itself.

Hiding the PHP version (expose_php=Off) makes you less visible, but fixes nothing.

  1. PHP, ChangeLog 8, 21 October 2026. php.net
  2. NCSC (UK), Critical security issue affecting PHP, October 2026. ncsc.gov.uk
  3. NSA advice on php2shell, as reported by TweakTown, 22 October 2026. tweaktown.com

Frequently asked questions.

What is php2shell?

A serious flaw in PHP, the language about 70% of websites run on.1 Since 21 October 2026 there is a fix in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Governments in the Netherlands, Germany, Finland, Belgium and France temporarily took websites offline.2

What does "Your site shields this" mean?

Your server doesn't show which PHP version it runs, or we couldn't read your site. That's fine in itself, but it means we can't see from the outside whether PHP has been updated. Book a call or fill in the form and we'll look at it together.

Is green a guarantee?

No. Green means the version your server shows contains the fix. It says nothing about an earlier break-in, other PHP versions on the same server, or the rest of your website.

  1. W3Techs, usage of server-side languages, August 2026. w3techs.com
  2. The Next Web, 21 October 2026. thenextweb.com

Claim your free update.