Apache + mod_php
Remote code execution was confirmed against default settings. The attack happens before your site’s own code runs, so well-written code doesn’t help.
PHP2Shell · CVSS 9.2
Move your PHP site to a safer stack
On Oct 21, PHP disclosed two 9.2-severity flaws that let attackers run code on your server without logging in. Leave your email: we’ll check for free whether your site is affected, then propose a fix or a migration plan.
Got it. We’ll reply within 2 business days.
Added, thank you.
Which sites are most at risk
Both flaws are in the PHP core, regardless of which CMS or framework you run. The risk depends on your PHP version and how PHP is run.
Nginx + PHP-FPM
One flaw was confirmed to allow code execution on FPM when a suitable code path exists in the site. The other is so far theoretical.
PHP 8.1 and older
No longer maintained and will not be patched. The only fix is a major upgrade, or a migration.
As of Oct 22 there are no known attacks in the wild, but the details are public and exploits are a matter of time.
Two ways to handle it
Stop the bleeding: upgrade and harden
For sites that will stay on PHP for now
- Upgrade to the fixed release of your branch
- Apply the official temporary hardening if you can’t upgrade yet
- Check logs for signs of past attacks
Fix it for good: migrate the stack
For sites on unsupported PHP, unmaintained for years, or scary to touch
- Move to an actively maintained stack such as Next.js, a static site with a headless CMS, or a Node.js backend
- Keep your URL structure and 301-redirect anything that changes, so rankings stay put
- Retire the old server only after the new site is stable
How a migration works
-
1
Free check
We review your PHP version, setup, plugins and data size to see if you’re affected.
-
2
Plan and quote
Fix or migrate, to what, how long and how much.
-
3
Build
The new site is built and tested separately while the old one keeps running.
-
4
Switch over
We move the domain, verify redirects and indexing, then retire the old site.
FAQ
Do I have to change my stack?
Not necessarily. Upgrading to the fixed release closes these two flaws. After the check we’ll tell you honestly which option fits.
Can you migrate a WordPress site?
Yes. Posts, pages and media move over as a whole. Plugin-based features (forms, memberships, shops) are assessed one by one for replacements.
Will a migration hurt my search rankings?
We keep your URL structure, 301-redirect anything that changes, and check indexing before and after launch.
What do you need for the check?
Just your email and site URL to start. If we need server details, we’ll explain what and why by email.
Start with a free check
Leave your email. We’ll tell you whether your site is affected and whether to fix or migrate.
Got it. We’ll reply within 2 business days.
Added, thank you.