For WordPress, WooCommerce, Laravel, Symfony, Shopware, PrestaShop and other PHP applications
Up-to-date, secure PHP — without rewriting your application
PHP receives security fixes only in supported versions, yet many applications still run on versions that no longer get them. Critical vulnerabilities such as PHP2Shell (CVE-2026-109618, CVE-2026-109619) make that risk concrete. I assess where your PHP runs, move the application into containers with a supported runtime and a reproducible development environment, and, if you wish, host and operate it for you. Your developers keep working on the code; I take care of the environment it runs in.
Why outdated PHP is a risk
Each PHP version receives security fixes for a limited period. After its end of life, vulnerabilities found in it stay open, and upgrading is the only lasting fix. The PHP project publishes the support period of every version.
PHP2Shell, disclosed in October 2026, is an example. Two critical vulnerabilities in the PHP engine itself (CVE-2026-109618, CVE-2026-109619) allowed remote code execution without authentication, before any application code ran. The PHP project published fixed releases for its supported versions only; configuration changes reduced the exposure but did not make an installation safe.
The application itself is often not the weak point: a well-maintained WordPress site or Laravel application can still be exposed because the PHP version beneath it is outdated. Moving to a supported version sometimes requires changes in the application code. Those stay with your developers or your agency; I provide the environment in which they can test the change and roll it out safely.
Three things to keep in mind
- Security fixes are published only for supported PHP versions. The list of supported versions and their end dates is on php.net.
- Configuration and firewall rules reduce exposure, but they do not replace an update. For PHP2Shell, the PHP project stated this explicitly.
- Vulnerabilities are found faster than before: researchers found PHP2Shell with the help of AI models, and the same capability shortens the time between a disclosure and a working exploit.
References
Checklist
Five questions for every website or application that runs on PHP.
Do you know which PHP version each of your sites and applications runs on?
Including test environments, old microsites and tools that your hosting provider or agency set up years ago. The version is usually shown in the hosting control panel; a server or container image inventory shows the rest.
Is that version still supported?
The PHP project lists the supported versions and their end dates. A version past its end of life receives no security fixes, not even for critical vulnerabilities.
Who updates PHP, and how often?
On shared hosting it is the provider’s decision; on your own servers it can easily become nobody’s task. If an update requires manual work on a server, it tends to be postponed.
Can your developers test a new PHP version before it goes live?
Without a reproducible development and test environment, an upgrade is tested in production — which is why it is often avoided.
Would you notice if something went wrong?
Monitoring of errors, availability and unexpected processes shows an attack or a failed update before your customers notice it.
If any answer is “no” or “not sure”, the first step below covers it.
How I can help
Three steps. Each ends with a written result and can be commissioned on its own. Your developers or agency keep working on the application code.
Assessment and advice
Where PHP runs, how exposed it is and what to do first.
- Inventory of your PHP sites and applications, their versions and their hosting
- Assessment of the exposure and of the upgrade effort, in plain language
- A written recommendation with priorities: what to fix now and what to plan
- Advice to your developers or agency on the upgrade path
Containers and development environment
A reproducible setup in which the application runs on a supported PHP version.
- The application packaged in containers, with a supported PHP runtime that is easy to update
- A development environment your developers can start with a single command, identical to production
- An automated pipeline that tests and builds new versions, including PHP security updates
- Hardening: least privilege, isolation and limits on incoming requests
Hosting and operations
On request, I host and operate the application for you.
- Operation of the containerised application in an environment I manage
- PHP and base image updates as routine work, not as emergencies
- A planned move from your current hosting, including the switch-over
Scope and working model
Direct responsibility
I am an independent consultant. The work is carried out by me personally, from assessment to handover.
Scoped for small and mid-sized companies
The work is designed for companies without their own operations team: clear steps, written results in plain language and no long-running projects. Larger organisations are welcome as well.
Location and hours
Based in Alicante, Spain, working remotely with teams across Europe on Central European Time (CET/CEST). Engagements in English or Spanish.
Confidentiality and access
A non-disclosure agreement is in place before any system access. Access is least-privilege and time-bound, and no production change is made without your agreement.
Outside the scope
- Software development: writing or rewriting application code, in PHP or any other language. Code changes stay with your developers or agency; I provide the environment and the advice.
- Forensic investigation of a suspected compromise. I recommend engaging an incident-response provider — often the firm on your cyber insurer’s panel — and can work alongside them.
I work as an independent consultant on AWS infrastructure, CI/CD and automated compliance controls (eIDAS, ISO 27001, NIS2, GDPR) for regulated environments. See experience
Questions
Is a firewall rule (WAF) enough?
No. A web application firewall can block known attack patterns while you update, but it cannot fix a vulnerability in PHP itself, and attackers adapt their requests. For PHP2Shell, the PHP project stated that only an update is a complete fix.
We use shared hosting. Does this concern us?
Yes: the PHP version is part of your hosting. Check which version your provider runs and whether you can choose a supported one. If the provider cannot offer a supported version, moving the application into containers is the cleaner long-term option.
Our application runs on a PHP version that is no longer supported. What are the options?
Upgrading to a supported version is the lasting solution. Until then, a distribution or long-term-support vendor package with backported fixes, together with strict isolation of the application, reduces the risk. With the application in containers, the upgrade can be tested before it goes live.
Do we need to rewrite the application in another language?
No. A security issue in PHP is not a reason to rewrite an application. What helps is keeping the runtime current: knowing where it runs, rebuilding the images when fixes are released and upgrading before end of life.
Can you host the application for us?
Yes, on request. Once the application runs in containers, I can host and operate it in an environment I manage, so that the PHP version and its dependencies stay up to date. You can also keep your own hosting, provided it can run containers.
Does NIS2 apply to us?
It depends on your sector and size, and on how your country has transposed the directive. Where it applies, handling known vulnerabilities is part of the required risk-management measures (Article 21), and the management body is accountable for them (Article 20). Your legal or compliance adviser can confirm whether you are in scope.
Schedule a consultation
Describe your situation briefly: which sites or applications, their PHP version if known, and where they are hosted. Please do not send passwords or access details through this form.