Is your website exposed to the new PHP flaw?

On 21 October PHP released an emergency fix for two critical flaws, known as PHP2Shell. PHP is the software behind most small business websites, WordPress included. One request from an attacker is enough to take over an unpatched server, and attacks have already been seen in the wild.

The fix is an update to the PHP version on your server. Plenty of hosts haven't rolled it out yet.

This is a quick first look. Many servers hide their version or report an old number even when patched, so I always confirm by hand.

£199 flat. Done same day.

If you're already patched, you pay nothing.

How it works

  1. Send me your web address. I'll tell you the same day whether you're exposed.
  2. If you are, I update PHP to the patched release, or get your host to do it if you're on shared hosting.
  3. I test the site afterwards and send you a short before and after report for your records.

Questions

What is PHP? The engine your website runs on. You never see it, and it's where the flaw is.

Will my site change? No. Visitors won't notice anything.

What if something breaks? I take a full backup first and stay on the same PHP version line, so the update is a security patch, not an upgrade. If anything misbehaves I roll it back.

I'm on shared hosting. Isn't this my host's job? It is, and some have already done it. I'll check whether yours has, and if not I'll chase them for you.

Ready?

Email hello@phpfix.co.uk with your web address.