Free PHP2Shell exposure check for UK SMEs
On 21 October 2026 the PHP project released emergency fixes for two critical flaws, now called PHP2Shell, that let an attacker take control of a web server with a single request. PHP runs underneath most websites, including every WordPress, WooCommerce, Drupal, Joomla and Magento site. Updating the website software does not fix it. The server underneath has to be updated.
If you cannot say which PHP version your website is on today, we will find out for you. We check what you have facing the internet, confirm the PHP version on each, confirm whether it is patched or merely claimed to be, and send you a one-page list of what to fix and who to chase. Free, no strings, for the first 20 UK SMEs who ask before Friday 30 October. If we find something that needs fixing we will say what it is and quote for that separately. If you are fine, we will tell you that too.
Not sure what you run? See which website software is affected, and how to check your PHP version.
Thanks. We will be in touch within two working days with your findings. If your site turns out to be on a hosting platform that has already patched at platform level, that will be a short email.
What we do: read publicly visible information about your sites (server headers, hosting provider, common software paths). We do not attempt to exploit anything or send anything unusual to your servers. Where a scan would help, we will ask for your written permission first.
What we do not do: store your details beyond this check, share them with anyone, or add you to a mailing list.