Your Website's PHP Could Be Wide Open. We Fix It — Properly.

On October 21, 2026, the PHP team issued an emergency fix for PHP2Shell — two critical flaws (9.2 out of 10) that let attackers run code on unpatched servers with no login at all. Attackers were probing sites before the announcement, working break-ins were confirmed within days, and CISA has listed both flaws as known-exploited with an October 29 deadline.

WordPress updates do not fix this. Your server’s PHP version does — and PHP 8.1 or older will never be patched. If your site is on an old version, upgrading is the only safe move.

• Exact version audit — the full PHP version number on your server (not just “8.3”), checked against the October 21 emergency fix: 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12.
• Full backup first — a complete, restorable backup of your site and database before anything changes.
• Patch or upgrade — the patched release for your branch, or a safe upgrade to a supported branch if you’re on 8.1 or older.
• PHP worker restart — the step most providers skip. Patching without restarting leaves the vulnerable code running.
• Compatibility testing — your forms, checkout, logins, and key pages tested after the change; staging first when a version jump is needed.
• Compromise scan — because probing began October 17, we check for planted files, rogue admin users, and unfamiliar scheduled tasks.
• Written confirmation — a short report stating your before/after versions and what was verified, so you hold proof, not promises.

• Any business whose website runs on WordPress or PHP.
• Site owners on PHP 8.1 or older — the urgent case, because no patch exists for you.
• Anyone whose host “handled it” but never sent anything in writing.

1. Check — free version check; we tell you exactly where you stand.
2. Quote — one fixed price for the fix, before any work begins.
3. Fix — backup, patch or upgrade, restart, compatibility test.
4. Verify — compromise scan and 24–48 hours of monitoring.
5. Report — written confirmation of your protected version.

Keeping your site patched and current is part of what our team does every day. If we manage your site, your version check is already on our list — and if a provider who doesn’t know your site sends you a scare email about PHP this week, forward it to us and we’ll answer it for you.

McBorrough Creative Agency — Web Design · Branding · Marketing · Web Hosting. Centreville, VA, serving the DMV and clients nationwide.