Taazaa.AI Get the check

PHP2Shell response · Legacy PHP Rescue

A new PHP flaw is being exploited.Find out if your site is exposed.

It's called PHP2Shell, and it sits in PHP itself, so updating WordPress won't close it. In 48 hours, you'll know where every server you own stands and what to fix first. Where no patch exists, we take you to a supported version.

  • Every PHP server you own, inventoried and version-confirmed from the inside
  • Checked for signs of compromise since October 17
  • Patched where a patch exists, upgraded or rebuilt where one does not
Get the exposure check Find your PHP version ↓

Read-only access to start. Nothing changes on your servers until you've seen the plan.

  • Your ranked list in 48 hours
  • Read-only access, never root
  • One point of contact, no ticket queue
  • You see the number before you commit
OpenAISelect
Partner
AnthropicClaude Partner
Network
SOC 2
Type II report
Building software from Hudson, Ohio since 2007

You patched what you could. This flaw sits one layer below.

If your team already updated WordPress, your plugins and your login screen, that was the right call. PHP2Shell lives underneath all of them, in PHP itself, and it's being exploited now.

On PHP 8.2 or newer, the fix is a new release and a restart. On 8.1 or older, there is no official patch to install, and on most older applications the upgrade breaks something. The fix itself is often the easy part. The hard part is knowing every server you own, which version is really serving requests, and whether anyone got in before the patch.

That's the work we take off your plate: found, confirmed and ranked in 48 hours, then fixed in the order that protects you first.

9.2

Severity score for both flaws.

Unauthenticated remote code execution, no password needed.

Oct 17

First exploit attempts seen, four days before the fix shipped.

Logs from this date forward need review.

35%

of WordPress sites run a PHP version the PHP project no longer patches.

Those versions have no official PHP2Shell patch, and updating WordPress won't change them.

Dec 31

PHP 8.2 reaches end of life.

Sites patched today are two months from being unpatchable again.

Who this affects

Find your PHP version. See what it takes.

If your site is on a managed host such as WordPress.com, WP Engine or SiteGround, they patched their fleets and your main site is covered. If you run your own servers, a VPS or a cloud instance, or an agency hosts your site for you, this table is for you.

PHP versionStatusWhat it takes
8.2, 8.3, 8.4, 8.5Patch availableInstall the fixed release and restart every PHP worker. A missed restart leaves the old code running.
7.4, 8.0, 8.1Source backport onlyNo packaged release. The fix has to be compiled in by someone who knows the build, then tested against your application.
7.3 and olderNo fix existsNothing to apply. The application has to move to a supported PHP version, which on most older code means an upgrade project or a rebuild.

What you get

A complete picture, and a plan you can act on.

Every deliverable is yours to keep, whether we do the fixes or your team does.

Server inventory

Every PHP endpoint under your domains and IP ranges, including the forgotten ones: staging boxes, old microsites, vendor portals, internal tools.

Runtime confirmation

The real PHP version serving requests on each server, read from inside. Public headers are a useful first signal, but they can be hidden, rewritten by a CDN or proxy, or show only one server. And the command-line version is often not the one your web server uses.

Compromise review

Web server and PHP logs from October 17 forward, checked for the request patterns these flaws use. A successful exploit can return a normal page and leave no error.

Ranked patch plan

Each server with its exposure, its fix path (patch, backport, upgrade or rebuild), effort, and the order to do them in.

For servers with no patch

Legacy PHP Rescue

Stabilize this week with web firewall rules, worker restarts and a backport where one exists, then move the application to a supported PHP version. Where the code cannot be upgraded, we rebuild the parts that block it. You end with a supported runtime, a repeatable deployment, and a maintenance plan so December 31 does not put you back here.

"Every server we own is on a supported PHP version, we know nobody got in, and the next deadline is already on the calendar."

That is the sentence we want your IT lead to say to your board. Not "we think we're patched."

How it works

Three phases. Each one ends with something you keep.

You see the full picture before anything changes on your servers, and the price of the rescue before you commit to it.

Hours 0 to 48

01Check

Read-only access. Inventory, version confirmation, log review, ranked plan. Nothing changes on your servers in this phase.

Week 1

02Stabilize

Patch what can be patched. Backport where it exists. Firewall rules and worker restarts on everything else. Verified from the inside, not by headers.

Weeks 2 to 8

03Upgrade or rebuild

Move the no-patch applications to a supported runtime. Fixed scope, fixed fee, agreed after the check so there are no surprises.

Who shows up. A senior engineer who has done PHP runtime upgrades before and a delivery lead who owns the timeline. One point of contact. No ticket queue.

Fees and how to start

Two engagements, one credited into the other.

Start with the check. If it turns up servers with no patch, the full check fee comes off the rescue.

PHP2Shell Exposure Check

$2,500fixed fee
48 hours
  • Server inventory and runtime confirmation
  • Compromise review from October 17
  • Ranked patch plan with effort for each server
  • Patch and restart on up to 5 supported-version servers included

Full fee credited against Legacy PHP Rescue if you proceed within 30 days.

Legacy PHP Rescue

from $25,000fixed scope
2 to 8 weeks
  • Stabilize in week 1 (firewall rules, backport, restarts)
  • Upgrade to a supported PHP version, with regression testing
  • Rebuild the parts of the application that block the upgrade
  • Repeatable deployment and a maintenance plan through the next end-of-life date

Scoped and priced after the check. You see the number before you commit.

From your first message to a ranked list

  1. 01

    Send your domain

    Use the form above or email. We reply with what your public headers show and whether it looks like you need the full check.

    Today
  2. 02

    20-minute call

    Who hosts what, who has access, and whether anything looks wrong already. We confirm scope and the number.

    Same day
  3. 03

    Read-only access

    A limited account on each server, or a session with your admin. We never need root to confirm versions and read logs.

    Day 1
  4. 04

    Ranked list delivered

    Every server, its status, its fix path, and what we recommend doing first. Patches applied on the supported-version servers.

    Hour 48
  5. 05

    Rescue scope and fee

    If you have servers with no patch, a fixed-scope proposal for moving them. Your check fee comes off the top.

    Day 3
Request the exposure check We reply the same day with what your public headers show.

Questions

Asked on almost every first call.

Straight answers, including the ones where you don't need us.

Our host says we're protected. Are we done?

If it is a managed host, probably yes for your main site. Ask them in writing for the installed version and the restart date. Then ask yourself about the servers they do not host: the old VPS, the vendor portal, the intranet tool.

We installed a security plugin. Does that cover it?

No. The flaw is below the plugin. A web firewall buys time while PHP is patched. It is not a substitute for patching, and plugin vendors say so themselves.

Can't our developer just update PHP?

On 8.2 and newer, yes, and they should today. On 8.1 and older there is no package to install, and on applications written for PHP 5 or 7 the jump to a supported version usually breaks code. That is the part we do.

How do you know you're not already in our server?

We don't, until we look. That is why the check includes a log review from October 17. Patching a server that was already compromised closes the door with someone inside.

What happens on December 31?

PHP 8.2 stops receiving fixes. Any server patched to 8.2.35 today needs to be on 8.3 or newer by then. The rescue plan takes you there, not just to this week's fix.

Do you scan companies without permission?

No. The free domain check reads the version your server already announces in its public headers, the same way a browser does. Everything else happens with access you grant.

Get started

Six openings this week. Then the queue starts.

Unpatched PHP servers are being probed right now. Send your domain today, and within 48 hours of access you'll know where every server stands and what to fix first.

What happens next

  • We reply today with what your public headers show.
  • A 20-minute call the same day to confirm scope and the number.
  • Read-only access on day 1. We never need root.
  • Your ranked list at hour 48, with the check fee credited if you go on to the rescue within 30 days.

Already know you are on PHP 7 or older? Say so in the form, and we'll skip the check and go straight to a rescue scope.

Request the exposure check

Tell us where to look. We reply the same day.

Form not loading? Email hello@taazaa.com.