Two critical flaws in the PHP core (CVSS 9.2) let attackers take over your web server without logging in — and they are already being exploited. WordPress, TYPO3, Shopware or custom code: we patch, look for signs of compromise and lock your site down.
We load your homepage once — like a browser — and read what your server reveals about PHP.
Nothing invasive — just a normal page visit. Our team also receives the result so we can help you.
Safe from PHP 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35
PHP2Shell is the name for two critical security flaws in the core of PHP, the language that powers WordPress, TYPO3, Joomla, Shopware and a large share of the web. Details leaked early on 20 October 2026; the PHP project shipped fixes on 21 October, and agencies including CISA, CERT-EU and Germany's BSI issued urgent warnings.
Many site owners assume they're safe because WordPress is up to date or their host will update “at some point”. These four things are almost always missed:
The flaw lives in PHP itself, not in your CMS. An up-to-date WordPress can still run on unpatched PHP. What matters is the PHP version on your server.
The first exploitation attempts were seen on 17 October. If you were exposed, you need to check whether someone already got in — a backdoor survives every update.
CVE-2026-109618 can leak memory from other requests — such as passwords, session tokens or API keys. After patching, credentials should be rotated.
PHP 8.1, 8.0 and 7.x get no official release. The only options are a backport, an upgrade — or moving to a modern stack.
Seal it now, leave PHP for good, or have us look after it — your call. Every package starts with a free, no-obligation first assessment.
For everyone who needs to be safe right now — whatever the system.
from€490one-off
Leave PHP behind — move to a fast, modern stack.
from€4,900per project
We keep your website secure. You run your business.
from€149/ month
All prices are net, plus 19% German VAT where applicable. You get a fixed price after the first assessment — before we start.
How to find your PHP version: in your hosting control panel (often under “PHP settings”) or in WordPress under Tools → Site Health → Info → Server.
If even one of these applies, check your site with our free tool — or just send us the address.
Check automatically nowWhatsApp, call or email. Your website address is all we need to start.
We check your PHP version, hosting and risk — and give you a fixed price.
Patch, hardening, compromise check and fresh credentials. We keep your site online wherever possible.
You get a plain-language summary and concrete next steps.
From a small WordPress site to a custom-built shop — with any host, on shared hosting, a VPS or your own server.
We know PHP inside out: many of our own projects run on WordPress and WooCommerce.See our work
PHP2Shell isn't the first critical PHP flaw and won't be the last. If you were planning to modernise anyway, this is the best reason yet.
| Topic | PHP / WordPress | Next.js (twentyfirst.dev) |
|---|---|---|
| Affected by PHP2Shell | Yes, unless patched | No — no PHP runtime |
| Attack surface | PHP runtime, CMS, theme and plugins on the server | Pre-rendered pages, minimal server code |
| Maintenance | Constant updates for core, theme and often dozens of plugins | A few vetted dependencies |
| Speed | Depends on plugins, caching and hosting | Served from a CDN, very fast load times |
| SEO & Core Web Vitals | Achievable — with effort | Excellent out of the box |
To be honest: no technology is unbreakable — Next.js has had security flaws too. The difference is a much smaller attack surface. With our managed security service we apply updates within 24 hours.
PHP2Shell refers to two critical security flaws in the PHP core (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2). They let attackers run code on a web server without logging in. Details leaked early on 20 October 2026, and patches were released on 21 October.
Very likely, if your server hasn't been updated yet. WordPress, TYPO3, Joomla, Shopware and others all run on PHP. What matters isn't your WordPress version but your server's PHP version: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or newer are safe.
The quickest way is our free check at the top of this page — if your server reveals its version. Otherwise, look in your hosting control panel (usually under “PHP settings”) or in WordPress under Tools → Site Health → Info → Server. Or just send us your website address.
The update stops new attacks but doesn't undo a break-in that already happened. Because attacks started before the patches, you should have your site checked for backdoors, rogue admin accounts or modified files — and rotate credentials, since CVE-2026-109618 can leak memory contents.
The emergency fix starts at €490 net. After the free first assessment you get a fixed price before we start. The switch to Next.js starts at €4,900 and managed security at €149 per month.
You'll get a reply in under an hour. Securing your site is usually completed within 24 hours of your go-ahead.
PHP 8.1, 8.0 and 7.x get no official release. Short term, we apply a backport or upgrade you to a supported PHP version and test your site on it. Long term, we recommend an upgrade or a switch to Next.js.
The PHP Foundation announced a third flaw on 23 October 2026. According to the Foundation it is only exploitable with a very unlikely combination of configuration and application code and can be mitigated through configuration. The fix will ship with the next regular release. Our emergency fix applies the mitigation right away.
No technology is unbreakable. But a Next.js site serves pre-rendered pages and needs no PHP runtime and no plugins, so its attack surface is much smaller. It is not affected by PHP2Shell. With managed security we keep it up to date as well.
Depending on your setup: your hosting control panel, SSH or SFTP, or an admin login for your CMS. We treat everything confidentially and can sign a GDPR data processing agreement (DPA) on request.
Yes. We work fully remotely, in English and German, for clients in Germany, Austria, Switzerland and worldwide.
Reach us however is fastest for you. Reply in under an hour.
twentyfirst.dev is an independent service provider and is not affiliated with the PHP project, the PHP Foundation or the BSI. Information provided to the best of our knowledge, based on the sources listed.