Critical PHP vulnerability (PHP2Shell, 21 October 2026): is your website patched?
Check and fixBLOG
Short, hands-on articles: how to check what your website runs on, when to upgrade and what to watch out for along the way.
Updating WordPress does not fix PHP2Shell. The fix sits in PHP itself. Here is how to find the version your site really runs, in Site Health, your hosting panel or on the server, and how to read the result.
Read the articleEnquiries typed into a CRM by hand, orders copied into the accounting package, bookings added to a calendar manually. Each of these is an integration waiting to happen. What integrations are, which ones pay off first, and what to decide before building one.
Read the articleMost business problems are solved by software that already exists. Some are not, and the symptoms are recognisable: spreadsheets between tools, staff working around the system, paying for features you do not use. How to tell the difference, and what a sensible first version looks like.
Read the articleDevelopers quote against what they understand, so a vague request gets vague, incomparable quotes. A one-page brief fixes that. Here is what to put in it, what you can safely leave out, and a template to copy.
Read the articlePHP 8.1 received no PHP2Shell release, so Laravel applications still on it need to move. The PHP change itself is quick; the work is in the framework version, the dependencies and the server configuration that quietly still references 8.1. A checklist.
Read the article"We need an app" is one of the most expensive sentences in small-business technology. Sometimes it is true. This article sets out when a mobile-friendly website is enough, when an installable web app is the sweet spot, and when a native app is genuinely justified.
Read the articleThe PHP2Shell releases cover PHP 8.2 and newer only. If your site still runs 7.4, 8.0 or 8.1, a patch is not coming. Here is what that means, which version to target and how an upgrade is done without breaking the site.
Read the articleIf PHP2Shell pushed you to update PHP 8.2 to 8.2.35, well done. But 8.2 stops receiving security fixes on 31 December 2026, so the next advisory will find you in the same position as the 8.1 sites are in today. Plan the move to 8.3 or 8.4 now, while it is calm.
Read the articlePHP's advisory lists several settings that reduce exposure while you wait for a patch. They are widely quoted and often misapplied. This is what each one does, where it must be set, and what it leaves open.
Read the articleHosting providers have been sending reassuring emails since 21 October. Most are right, some are early, and a few only patched part of their fleet. Here is how to check the package, the fix and the restart yourself instead of taking the email's word for it.
Read the articleAfter PHP2Shell, many site owners discovered they did not know who updates the PHP under their website. This guide maps the responsibility per hosting type and points out the three gaps where sites fall through.
Read the articleMost website quotes you receive will be for one of two things: a WordPress site or a custom build. They solve different problems. Here is how to tell which one your business needs, before you compare prices.
Read the articleLET’S MAKE YOUR NEXT MOVE
Tell us where you want to go. We can help you shape the website, application or integration to get started.
Let’s talk about your project