Website Without PHP
English (United Kingdom)GB
  • English (United States)
  • English (United Kingdom)
  • Dutch (Netherlands)
  • Dutch (Belgium)
Menu

PHP problems fixed, without the panic

Is your website broken, or running on outdated software that puts it at risk?

Which PHP version does your site report?

We read only what your site already sends in public: the headers and the top of the homepage. No scan, no login.

Check your site below

More about this

We explain in plain language what is going on and what to do now.

A person replies within one working day.

See our services

PHP 8.4.27Up to date

One team for the emergency and the cure

The Website Without PHP team works from Nijmegen, the Netherlands. We fix what is urgent, then remove the cause so the same scare does not come back.

  • Emergency fixYour site is down or broken right now. We stabilise it first, then explain in plain language what we found.
  • PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. updateMove to a safer version of PHP, tested on a copy of your site first, with a way back if something goes wrong.
  • Rebuild without PHPRebuild the site so it no longer needs PHP at all, which leaves nothing to keep patching.
  • PHP services: fix, upgrade, migrate or rebuildPHP services from one team: emergency PHP fix, PHP upgrade, migration and a rebuild without PHP. From-prices on every page, reply within one working day.
  • Emergency PHP fix for broken sitesEmergency PHP fix for a site that is down, broken after an update or on unsupported PHP. Excl. VAT, reply within one working day, Mon to Fri.
  • PHP upgrade to a supported versionPHP upgrade service: we move your site to a PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. that still gets security fixes, tested on stagingA staging environment is a private copy of your website where you try updates first, so any mistakes happen there and not on the live site. with a rollbackA rollback means going back to the last version of your website that worked, after an update has gone wrong. plan. Prices excl. VAT.
  • PHP migration to a modern stackPHP migration for sites on old hostingWeb hosting is the service that keeps your website's files on a computer that is always online, so visitors can open your site at any time.: supported PHP version, working plugins and updated code, with a rollback plan. From-prices excl. VAT.
  • Rebuild your site without PHPRebuild your website without PHP on a static or edge stack such as AstroA static site generator, such as Astro or Hugo, is a tool that builds all the pages of a website in advance, so visitors get ready-made files. on Cloudflare. No PHP left to patchA security patch is a software update that closes one known security weakness and adds nothing else, so installing it protects you against that problem.. Excl. VAT, one working day reply.

A free check that only reads what your site shows in public

The PHP Exposure Check only looks at what your site already tells every visitor, such as the PHP version it shows. It never logs in and never scans for weaknesses. You see which version you run and whether it still receives security fixes, before you talk to anyone.

Where the version is not visible, we tell you so instead of guessing.

  • Free PHP Exposure CheckFree PHP exposure check. We read public headers and the top of your homepage to show which PHP version your site runs and whether it still gets security fixes.
  • Check Your PHP VersionFind your PHP version in WordPress Site HealthWordPress Site Health displays diagnostic checks and technical information about your WordPress website. or your hosting panel. The free check reads public headers and the top of your homepage.
How the free check works
  1. Step 1 You enter your domain No login and no password needed.
  2. Step 2 We read what your site sends publicly The headers and the top of the homepage. No scan.
  3. Step 3 You see the PHP version and what it means With source and date.
  4. Step 4 Need help? A person takes a look We reply within 1 working day.

PHP2Shell: the current status

Status: fixed releases available, update now Last update:

The short version. Every line has its source and the time we checked it.

Fixed releases
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 Source: php.net security advisory, checked
PHP 8.1 and older
No more updates from the PHP project. Assume these versions are affected too. Source: php.net security advisory, checked
Exploitation in the wild
CISA: both vulnerabilities added to the KEV list on 26 October (catalogue 2026.10.26); that does not say an attack succeeded. Since 27 October, CISA's SSVC assessment in both CVE records reads 'Exploitation: active', meaning reliable evidence that attackers are exploiting it in the wild; CISA does not say in those records whether an attack succeeded. Amazon: attempt on 17 October; whether it could succeed is unknown. Sophos: attempts blocked by Sophos protections (22 October correction). Previdian: no successful code execution (22 October). None of these sources reports whether any attack succeeded. Source: CISA KEV, checked

Full status, timeline and sources

How the flaw works, and how you fix it
  1. Step 1 Your site runs on PHP A version without the latest fix carries this risk.
  2. Step 2 The PHP project reports the flaw php.net, 21 October 2026
  3. Step 3 Your host or we update PHP To a fixed release: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
  4. Step 4 The fix is in Then confirm the version: with the check if your site reports it, otherwise with your host. Up to date
PHP 8.1 or older? No more updates from the PHP project. Then migrating or rebuilding is the route.
Source: php.net security advisory, checked on 22 October 2026.
  1. Domain
  2. Check
  3. Result
  4. Report

Which PHP version does your site run?

Enter your domain. We read only what your site already sends in public: the headers and the top of the homepage. No scan, no login.

We keep the domain and the result, never your IP address.