PatchPHP

Find and fix PHP2Shell exposure across the sites you manage.

We check the PHP runtime actually serving each site, not only the version on the command line. You get written findings, the open questions, and a quoted scope for the fix.

Start an assessmentUse the free checklist

For businesses, web agencies and managed IT providers running PHP on Ubuntu and Debian servers.

Assessments

Every engagement starts with an assessment of the environment as it is. You get written findings and a quoted scope for the fix. Nothing in production is changed during an assessment.

PHP response assessment

For a business that needs a clear answer on one PHP environment.

Scope, deliverables and exclusions
  • One server, up to five sites
  • Runtime and patch-status review
  • Prioritized written findings
  • A scoped remediation quote

$499 USD, one-time

Start assessment

Agency portfolio assessment

For agencies and managed IT providers responsible for several client environments.

Scope, deliverables and exclusions
  • Up to five servers and 25 sites
  • Inventory prioritized across clients
  • Patch status and remaining unknowns
  • A written remediation scope

$1,999 USD, one-time

Assess a portfolio

Remediation

Fixes are a separate engagement, quoted after the assessment. Standard remediation starts at $2,499, and your assessment fee is credited once toward it. Legacy changes and larger portfolios are scoped individually. How remediation is scoped.

Intake is currently limited to PHP on Ubuntu and Debian servers; other environments are reviewed case by case. Online checkout opens once payment setup and delivery capacity are confirmed.

What an assessment checks

A version number on its own answers very little. These are the questions we settle for every site in scope, and the reasons a quick check often gets them wrong.

The runtime serving requests
The version reported by php -v belongs to the command-line binary. A site can be served by a different PHP-FPM pool or Apache module. We record which SAPI and runtime actually handles each site.
Package source and vendor backports
Distribution and LTS packages often keep an older version number while carrying backported fixes. We identify where each runtime came from and check its vendor advisory instead of comparing version numbers alone.
Worker restarts
An updated package does not change PHP-FPM workers or Apache processes that are still running the old code. We check whether the processes serving traffic started after the update.
End-of-life branches
An unsupported branch gets no upstream releases, but a vendor or source backport may still exist. We record the branch status, any available fix and the upgrade path.
Exposed configurations
Some vulnerabilities depend on how PHP is wired to the web server, such as php-cgi handlers or PHP-FPM path handling. We note the configurations that past advisories have targeted.
What could not be confirmed
Anything we cannot establish from the evidence is recorded as unknown, with the question that would settle it. Unknown is never reported as safe.
One server, two answersIllustrative example for a fictional host
SourceReports
php -v on the command line8.3.36
PHP-FPM pool serving shop.example.test8.2.29

The command line looks patched. The pool that serves the shop is below the 8.2.35 fix. The sample report shows how this appears in a full set of findings.

How an engagement works

Everything happens in writing, in your dashboard. There is no sales call, and you decide whether to go ahead after reading the findings.

  1. Submit the environment

    Create an account, choose an assessment and add the site and hosting details.

  2. Read the findings

    The assessment, remaining unknowns and a proposed remediation scope arrive in your dashboard.

  3. Approve the work

    Review the scope, price, access arrangements and delivery window before paying for the fix.

  4. Review the evidence

    Follow progress and receive a report of deployed changes, checks run and anything unresolved.

Production changes need an agreed maintenance window and recovery plan. Automated routine patching is in development; until it is available, eligibility and delivery are reviewed individually. Read the full engagement process.

PHP2Shell response checklist

Work through this with your developer or hosting provider. It is free, needs no account and does not depend on buying anything from us.

Download the checklist (Markdown)
0 of 6 steps reviewed
0 of 6

Progress is saved in this browser only.

  1. Include production, staging, containers and applications that embed PHP. Give each one a responsible owner.

  2. The CLI version alone is not proof. Check the PHP-FPM or web server module in use, and your vendor’s backported fixes.

  3. Confirm you can recover, test compatibility, then deploy the official or vendor-fixed package. Restart affected workers.

  4. Check every affected instance and test business-critical journeys, including login, checkout and uploads.

  5. Patching does not undo an intrusion. Preserve relevant logs and escalate suspicious activity.

  6. Keep runtime and package versions, vendor references, test results and an owner for outstanding work.

Ticking these items records your own review. It does not scan your site or certify its security. Temporary mitigations do not fully resolve these vulnerabilities; the official interim measures are summarized on the advisory page.

Reference material

The facts we work from, with sources and the date we last checked them. Free to read and use.

PHP version support

Which branches still receive releases from the PHP project, and which have reached end of life.

PHP 8.2 reaches end of life on 31 Dec 2026.

Sample findings report

A complete example report for a fictional agency: runtime inventory, prioritized findings, remaining unknowns, remediation scope and evidence.

Common questions

Do we need a call to use PatchPHP?

No. Submit the environment details online, review findings and quotes in the dashboard, and approve work in writing. Questions and updates are handled asynchronously.

Does an assessment include the fix?

No. An assessment delivers findings and a remediation scope. You approve a separate quote before any production work. The assessment fee is credited once toward the associated remediation job.

Can the service patch everything automatically?

Autonomous patch execution is under development. The first target is supported PHP-FPM environments on Ubuntu and Debian. Compatibility failures, unsupported environments and suspected compromise need specialist review.

Our hosting provider already manages PHP. Do we need this?

Ask them to confirm the fixed package, the deployed runtime and which sites are affected. If they already patch and verify, their service may cover you. The checklist above helps establish what is covered.

How is access to our systems arranged?

Access and authorization are agreed separately after reviewing the environment. Do not send passwords, private keys, access tokens or customer data through the dashboard or by email.

Start with an assessment

Choose the assessment that fits and add the environment details. Questions before you start can be sent through the contact form.

Start an assessment