PHP and WordPress security
Most of the web runs on PHP, and attackers know it. We find what your sites and servers run, patch it, harden it, and clean up if something has already got in.
On 21 October 2026 the PHP project released emergency fixes for two flaws, now known as PHP2Shell, that can let an attacker run their own code on a server without logging in. Every PHP installation that serves web pages is at risk until it is updated, attack traffic aimed at the flaws was reported almost immediately, and PHP's own advice is that there are no complete mitigations: updating is the only safe choice. PHP 8.1 and older no longer get fixes from the PHP project at all. WordPress, Drupal and Joomla all run on PHP, and so do a great many booking systems, portals and shops. PHP2Shell is the sharpest example of a standing problem: business websites on servers that nobody is patching.
Sources: PHP security advisory, 21 October 2026 · Wiz Research on PHP2Shell · Qualys on PHP2Shell
The work, named
- Find what you run
- Every site, server and hosting account: the PHP version each one really uses, the CMS, plugins and themes, and who has access to each.
- Patch and upgrade
- PHP brought up to a supported, fixed release and restarted so the fix is actually running, the CMS and plugins updated, and anything abandoned replaced or removed.
- Harden the server
- PHP and web server settings tightened, admin areas and file uploads locked down, and old accounts, keys and FTP logins closed.
- A firewall in front
- A web application firewall and rate limits that block common attacks before they reach the site, while patching happens and after.
- Backups off the server
- Copies kept away from the server they protect, so a compromise or a failed update can be rolled back to a known good state.
- Watch and alert
- Uptime, file changes and login attempts monitored, with alerts for the things that need a person.
- Clean-up after a compromise
- Find how they got in, remove what they left behind, close the gap, and restore from a copy taken before it happened.
Signs this is the one you need
- Your website, booking system or portal runs on PHP, WordPress, Drupal or Joomla
- Nobody can say which PHP version your server is running
- Plugins have not been updated for months, or were installed by someone who has since left
- The site has redirected visitors, sent spam, or been flagged by Google or your host
- Your host has emailed about PHP2Shell, an end-of-life PHP version or a security update
Four stages, same for every service
-
Review
The free review: what you run, what is exposed, and where the risk actually sits, written down. The document is yours regardless of what happens next.
-
Plan
A prioritised plan, sized to your business rather than pulled off a menu, with the quick wins named first.
-
Price
A fixed price in writing, with what is included named: monthly for a plan, once for a project. Nothing starts before you have seen it.
-
Revisit
The plan is revisited as the business changes, rather than left to drift out of date.
The things people ask
Is our site affected by PHP2Shell?
If it runs PHP older than the fixed releases (8.2.35, 8.3.36, 8.4.27 and 8.5.12), assume so until it is updated and restarted. Updating is the only complete fix. Settings changes and firewall rules reduce the risk while that happens, and on PHP 8.1 or older the real fix is moving to a supported version.
We are on shared hosting. Can you still help?
Yes. On shared hosting the server is the host's job, so the work is confirming which PHP version your account uses, moving it to a supported one, updating the site, and putting off-server backups and a firewall in place. If the host cannot run a supported version, we will tell you, and help you move.
Do you build or redesign websites?
No. Dacros secures and maintains them. Building and redesigning websites is our sibling practice VerySEOly, and when a site needs both, the two work from the same notes.
Sectors with their own requirements
Related, and the rest of what we run
- PHP2Shell: what to do if your website runs on PHP
- How to secure your business website
- Cyber security for online shops
- Managed IT support
- Cyber security
- Network engineering
- Telecoms and VoIP
- Data cabling
- Remote support
- Security for AI-built apps and websites
- Backups, disaster recovery and failover
- Sectors we cover
- How pricing works
Not sure which of these you need? That is exactly what the free review is for. Book the free review.