01 / VERIFY WHAT'S RUNNING
We identify the PHP runtime your website actually uses, establish who controls its updates and check whether the relevant security fix or vendor backport has been installed. A version number alone is not always enough.
PHP2Shell: Critical PHP Security Fixes for Your Website
FREE PHP SECURITY PRE-CHECK · NO SIGN-UP
CHECK YOUR WEBSITE
Check your public PHP signals. Find out what needs verifying.
Know your PHP version? Compare it manually
Ready to check public signals.
Website pre-check complete · 4/4 checks complete
- Checking public homepage
- Inspecting headers
- Identifying PHP signals
- Comparing reported version
PRELIMINARY PHP APPRAISAL
Your website · awaiting check
- Detected technology
- —
- Reported PHP version
- —
- Public evidence
- —
- Patch verification
- —
- Recommended action
- —
Run a free pre-check to see your preliminary findings.
Two critical vulnerabilities have been found in PHP, the technology behind WordPress, WooCommerce and many other business websites. On an affected, unpatched server, attackers may be able to execute code without logging in.
Official fixes are available. If your website uses PHP, now is the time to confirm it has been patched.
Studio DALI checks the actual PHP environment, applies or coordinates the necessary security updates and verifies that your website still works afterwards.
Tell us your website address. We’ll confirm the right next step before any paid work begins.
A website can look and work normally while the PHP running underneath it remains unpatched.
01 / THE RISK
This is a PHP security problem. Updating WordPress won't fix it.
The flaws are in PHP itself, not in a WordPress theme or plugin. That means an ordinary WordPress update is not the remedy. The PHP installation serving your website needs the correct security update, or verified protection supplied by its software vendor.
Your hosting company may already have applied it. But if your site runs on older PHP, self-managed hosting or a server that nobody actively maintains, assuming it has been fixed is a risk you do not need to take.
If the fix is missing, we help put it in place. If your host has already patched it, we verify the evidence and tell you.
02 / THE WORK
Check the server. Apply the fix. Confirm the result.
02 / PATCH OR UPGRADE
Where an update is needed and access allows it, we take a controlled backup, apply the appropriate fixed PHP release or supported vendor package, restart the affected PHP services and address immediate compatibility issues within the agreed scope. On managed hosting, we coordinate with your provider.
03 / TEST AND DOCUMENT
We check important pages and website functions after the change. You receive a dated summary of what was checked, what was updated, how the patch was verified and anything requiring further attention.
03 / YOUR WEBSITE
Is your website affected?
The issue concerns PHP on the server, so it can matter whether your site uses WordPress, WooCommerce, Joomla, Drupal, Laravel or custom PHP code. The important question is which PHP build is actually running, and whether its security fix is present.
Your website may need action if:
- Your hosting provider has not confirmed the PHP2Shell fix.
- Your site runs on a PHP version or package that has not received the relevant security update.
- You manage a VPS, dedicated server or older hosting account and have not applied the patch.
- Your website cannot move to a supported PHP release because older code, themes or plugins break.
Your website may already be protected if: your managed host has deployed and verified the fixed release or a supported vendor backport. We can help establish that without selling you an unnecessary server upgrade.
Which PHP versions contain the PHP2Shell fix?
| PHP branch | Security-fixed release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
PHP 8.1 and older are outside standard upstream support. Some hosting or operating-system vendors have issued security backports for older builds. We verify those against the vendor's evidence rather than judging protection from the displayed version number alone.
Latest security note (reviewed 24 October 2026): PHP also disclosed a narrower, configuration-dependent issue on 23 October 2026. Where relevant, we check the additional mitigation guidance rather than assuming the 21 October fixes cover every PHP security issue.
Official PHP security releases ↗04 / CLEAR PRICES
Clear starting prices. No unexplained security work.
You should know what we are checking, what we intend to change and what it will cost before work begins.
Studio DALI is not VAT-registered, so no VAT is added. Quoted prices are total prices.
PHP Security Verification
£125 total
For a site on shared or managed hosting, or where the immediate need is to establish the real patch status. Includes an environment review, host/vendor verification where available and a concise written finding.
Emergency PHP Patch & Verification
From £350
For straightforward hosting or self-managed servers requiring a PHP security update. Includes appropriate pre-change safeguards, installation or coordination of the fix, service restart, essential website testing and written sign-off.
Legacy PHP Website Upgrade
From £625
For older websites that cannot simply move to a secure PHP release. We assess compatibility, plan a controlled upgrade and test the result, with any substantial code or plugin repairs agreed separately.
Optional Ongoing Website Care
From £60 / month
Routine updates and maintenance for suitable small business websites, scoped separately from emergency patching.
These prices cover straightforward starting scopes. We confirm the work and cost before any billable changes. An agreed patch or upgrade includes its relevant verification work, so you are not charged for the same assessment twice.
GET A PHP SECURITY QUOTE05 / STUDIO DALI
Why leave the fix to Studio DALI?
One point of contact. Direct technical work. A clear outcome.
Studio DALI handles websites, software and the systems behind them. You deal directly with the people doing the technical work, not a chain of salespeople and account managers.
We will not recommend rebuilding a functioning site simply because a PHP update is needed. We establish what is already protected, identify what genuinely needs to change and explain your options before proceeding.
You get a working website, a clear record of the work and an honest account of any remaining risks. Not a vague assurance that everything is secure.
06 / FAQ
Questions before you act?
Does updating WordPress fix PHP2Shell?
No. PHP2Shell affects the PHP runtime used by WordPress and other applications. WordPress confirms that no WordPress core update is required or planned specifically for these flaws. The PHP server must be patched or the relevant vendor security fix verified.
My host says PHP has already been updated. Do I still need this service?
If your provider has installed and verified the appropriate fix, you may not need any remediation. We can check the actual runtime and supporting evidence, then give you a documented answer. We will not sell you an upgrade you do not need.
Can you help with WordPress, WooCommerce or a custom PHP site?
Yes, subject to the hosting environment and application complexity. Straightforward patching, more involved compatibility upgrades and bespoke PHP systems have different scopes, so we confirm what is needed first.
Will my website stay online during the update?
We plan changes to minimise disruption and check critical functions afterwards. Some updates require PHP workers or hosting services to restart, so a brief interruption may be unavoidable. We explain the approach before proceeding.
What if my website uses PHP 7 or another unsupported version?
An older site may need a staged upgrade rather than a simple version switch. Some vendors have backported this particular security fix to older packages, but that does not automatically make the whole runtime a suitable long-term platform. We check the immediate position and recommend the necessary migration.
Does a PHP security patch prove that my website has not been hacked?
No. Installing a fix addresses the specified software vulnerabilities; it does not establish whether earlier exploitation occurred. If there are signs of compromise, we explain the next steps and agree any further investigation or recovery work separately.
How quickly can you deal with this?
We prioritise urgent PHP security enquiries. The practical timescale depends on access, hosting-provider control and the changes required. We confirm the proposed work and timetable before starting; we do not promise a turnaround before understanding the environment.
07 / REQUEST A CHECK
Don't leave a critical PHP update unverified.
Send us your website address and, if you know it, your hosting provider. We will establish the next step, explain whether you need verification, patching or a more involved upgrade, and confirm the cost before any paid work.
Request an urgent PHP check
Do not send passwords or server credentials through this form. We will agree a secure access method if required.
How we handle enquiries: Privacy.
Prefer WhatsApp? MESSAGE STUDIO DALI
Further reading: Official PHP security releases · UK NCSC security alert · WordPress PHP security announcement