PHP Patch Service
Verified, reversible PHP patching — with a work report you can hand to your boss, your insurer, or a compliance file.
The scan reads only what your site discloses publicly — passive fingerprinting only; we never run exploit probes against a site. For a definitive verdict we run a read-only deep check on your server, then patch in one click and hand you a signed work report.
Watch how it works — 80 seconds
How it works
- Detect. Free external scan now; a read-only deep check on your server for a certain answer (most sites hide their PHP version — we verify you own the site first, then show you the exact plan).
- Snapshot. Before anything changes, we snapshot your runtime and restore-test the snapshot. If the safety net doesn't work, we don't touch your site.
- Patch. One click, with the old version kept serving until the patched build is verified. If our checks fail afterwards, the patch reverts automatically — free on every paid tier.
- Verify & report. Post-patch verification, then a PDF work report with an executive summary, the full audit trail, and a SHA-256 integrity hash.
- Rollback. Changed your mind days later? One-click rollback to the exact pre-patch state, verified against the pre-patch baseline.
Patched releases for php2shell
| Your PHP branch | You need at least |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| < 8.2 | No patch exists — upgrade the branch or take the site offline (CERT-EU) |
Pricing
| Scan — $0 | Patch — $49 | Patch + Rollback — $99 | |
|---|---|---|---|
| External scan & PDF report | Yes | Yes | Yes, plus rollback evidence |
| One-click patch | — | Yes | Yes |
| Snapshot before patch | — | Yes (internal safety net) | Yes, restore-tested |
| Automatic revert if our checks fail | — | Yes — free | Yes — free |
| Rollback when you ask | — | +$50 unlock | Included |
| Snapshot retention | — | 72 hours | Extended |
| Verification | Fingerprint | Version + health gate | Version + health gate + baseline-verified rollback |
The $49 tier's rollback lock is shown here and again in the plan you approve before we patch — an upgrade, never a surprise. And the guarantee: if a patch cannot be completed, or we cannot restore your pre-patch state, you pay nothing — a 100% refund. Recurring protection (we watch every PHP security release and re-patch on approval; multi-URL smoke tests and soak monitoring arrive with it): $299/year for Patch customers, $399/year for Patch + Rollback customers. Launches soon.
Governments are sounding the alarm
“An urgent request to act on tonight: check whether the websites you run use PHP, and be ready to apply the fix patch — released tonight at 11 p.m. — as quickly as possible. If prompt patching is difficult, temporarily taking the website offline is also an effective way to reduce the risk.”
Update — Oct 22: her own official website was handled the same way. Her office suspended access, carried out the necessary measures, and the site is now back online: “I have once again felt that temporarily suspending a site is an important step.”
- United States — CISA: “CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP… known as 'php2shell'.” www.cisa.gov
- European Union — CERT-EU: “CERT-EU advises organisations to patch affected assets immediately. Where that is not feasible, organisations should consider isolating internet-facing applications until a fix is applied and verified.” cert.europa.eu
- United Kingdom — NCSC: “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.” www.ncsc.gov.uk
- Australia — ASD's ACSC: Advisory “Critical vulnerabilities in PHP” — identify affected systems and prepare to patch. www.cyber.gov.au
- France — CERT-FR (ANSSI): “CERT-FR recommends taking affected servers offline, where possible, until the update is applied.” cert.cyber.gouv.fr
- Netherlands — NCSC: “Serious vulnerabilities in PHP — prepare to patch.” Dutch government sites, including DigiD, were taken offline as a precaution. www.rijksoverheid.nl
Proof: a real site, the night the fixes shipped
mitbbs.ai, a production forum on PHP 8.3.35 under Apache mod_php — the highest-risk configuration — was patched to 8.3.36 the evening of Oct 21 with ~10 seconds of interruption, verified live, with a full work report. The same playbook, automated, is what you are buying.
Superstar Telecom LLC · phpatch.com ·
Security & disclosure · Your data stays yours: backups are retained only for the window above and deleted on request.
Not affiliated with the PHP Group. PHP is a trademark of the PHP Group.