PHP2Shell: We secure your PHP application, even with no upgrade path
PHP 5, 7 or 8.1 with no patch? wunderwerk reviews your PHP application within a few days and secures it right away.
- 80+ projects
- 5.0 on Google
- Clients for 10+ years
- EU & GDPR first
- For web applications, portals, shops, Drupal and internal systems on PHP – including those built by other developers
What PHP2Shell means for your software
PHP2Shell is the name for two critical vulnerabilities in the PHP core (CVE-2026-109618 and CVE-2026-109619), made public on 21 October 2026. They let attackers run their own code on the web server without logging in. The first attacks are already under way, and the German BSI and the Swiss BACS advise updating immediately. The problem: for many PHP versions there is no update.
As of 22 October 2026. Sources: CVE-2026-109618 and CVE-2026-109619 (NVD), PHP security advisories (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp), supported PHP versions (php.net), BSI warning 2026-297981, BACS.
Affected
Every PHP version since 5.4
All applications on PHP 5.4 to 8.5, whether custom-built, framework-based, Drupal or another CMS. The vulnerability is in the PHP core, not in a module or plugin.
Patch available
Only PHP 8.2 to 8.5
Fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Install it, restart all PHP processes, check the version. According to php.net, security support for PHP 8.2 ends on 31 December 2026.
No regular patch
PHP 7.4, 8.0 and 8.1
The PHP project has only published unsupported source-code backports. Whether your hosting provider or your Linux distribution ships a patched package has to be checked case by case.
No fix
PHP 5.4 to 7.3
The PHP project no longer provides anything for these versions. The authorities’ recommendation: isolate the system or take it offline, and migrate. That is exactly where we help.
Where does your PHP application stand right now?
Since 21 October 2026, companies have been coming to wunderwerk in four typical situations: an old PHP version with no patch, a developer who can no longer be reached, a patch that exists but has not been installed, or an application on PHP 5. Each of them has a clear next step.
“We’re on PHP 7.4. Our hosting provider says we should switch, but then nothing works any more.”
Your application needs the old version because code, framework or libraries break on PHP 8. We secure it first (restrict access, block the attack vector, backups, monitoring) and then bring the application up to a supported PHP version in a controlled way.
“The agency no longer exists. We don’t even know where the server is.”
Together with you, we gain access to code, server and database, document what is there and take over the application. Afterwards there is someone again who knows it, maintains it and develops it further. No ticket system, a direct line.
“It runs on PHP 8.2, but who does the update without taking the shop offline?”
We install the update, restart all PHP processes, check the version that is actually running and search the logs for traces of an attack before the patch. Then we set things up so that future security updates are not left lying around again.
“The system is 15 years old, but our entire order processing depends on it.”
There is no fix for PHP 5. We take the application out of the firing line, secure the data and assess honestly whether a migration to PHP 8 is worthwhile or a rebuild is more economical. You get a recommendation backed by figures, not a gut feeling.
How we secure your PHP application
wunderwerk works in five steps: initial consultation, a fixed-price PHP emergency check, immediate measures, migration to a supported PHP version, then operation and further development. Every step has a clear outcome and a cost range, and you decide after each step whether to continue.
- 1
Initial consultation at short notice
30 minutes with the managing director: which PHP version is running, where is it hosted, who built it, what access is there, what depends on it? You get an honest first assessment of how urgent it is. Free and non-binding.
- 2
Fixed-price PHP emergency check
Within a few days: an inventory of all PHP runtimes (web, cron, workers, containers), the versions actually running, exposure to the internet, traces of compromise in logs and file system, the state of code, framework and dependencies, backups and access. The result: a written report, immediate measures and a roadmap with a cost range.
- 3
Secure immediately
What can be done today is done today. Install available patches and restart processes, block the known attack vector, restrict access to what is necessary, check backups, set up monitoring. For applications with no patch, this buys the time for the next step.
- 4
Upgrade to a supported PHP version
Migrate code, framework and libraries to PHP 8.3 or 8.4, with automated tests and reproducible deployment, so that the upgrade is not a leap in the dark. The old and new environments run in parallel, and we only switch over once everything has been checked. Where a migration is no longer worthwhile, we rebuild the core and take over data and workflows.
- 5
Operation & further development
Hosting in the EU, ongoing security updates in step with PHP releases, monitoring and support, plus new features when your business needs them. So the next vulnerability is a routine update, not an emergency. We have been looking after many of our clients for over ten years.
Thank you very much!
I will get back to you on the same working day.
If it’s urgent, book an appointment in my calendar right away: Book an initial consultation
Why not just switch to PHP 8?
Switching to PHP 8 in the hosting panel usually fails because the application breaks on the new version: an old PHP version is rarely still running out of negligence, but because code, framework or libraries cannot cope with PHP 8. The switch in the hosting panel is flipped in seconds, and so is the white screen that follows.
Typical reasons why PHP applications are stuck on old versions, and how we solve them.
- Removed functions
mysql_*, ereg, each, create_function and other functions no longer exist in PHP 7 or 8. We find every occurrence automatically and replace it, including database access with prepared statements instead of concatenated SQL strings.
- Frameworks without support
Drupal 7 (end of support January 2025), Zend Framework 1, CodeIgniter 2, CakePHP 2, Symfony 2, Laravel 4 or 5, Yii 1: systems that no longer receive updates themselves. We migrate to a current version, for Drupal to 10 or 11, or replace the framework module by module.
- Stricter error handling in PHP 8
What used to be a warning is now a fatal error. We run the application through static analysis and tests before it goes live and fix what PHP 8 rightly flags.
- No tests, no deployment, no staging
Changes are pushed to the server via FTP in the hope that they work. We set up a staging environment, automated tests and reproducible deployment. That turns a risk into a routine task, including for the next update.
- Honest, even if the answer is “rebuild”
When every line would have to be touched, a rebuild is often cheaper than a migration. We tell you so after the PHP emergency check, backed by figures, not beforehand on principle.
More than a patch: what remains after the fix
PHP2Shell is the trigger, not the real problem. The real problem is a PHP application that nobody can change safely any more, and wunderwerk solves that at the same time.
Not just clients. Partners.
We focus on long-term partnerships. You stay flexible thanks to open standards and clear documentation.
What our clients say:
A selection of our client feedback.
★★★★★Many thanks for building and looking after our online learning platform.
We can wholeheartedly recommend Christoph and his entire team.
Whatever we ask for, almost everything is made possible, and the ongoing personal contact works brilliantly too. Many thanks.
We run the online shop thecurtain.shop for made-to-measure curtains and Roman blinds.
Working with wunderwerk was excellent in every respect.
Thanks to their work, we can offer our customers an intuitive, professional shopping experience that perfectly reflects our craftsmanship. Many thanks for the great collaboration!
Very likeable wunderworkers! Fast, uncomplicated, competent and always ready to save the world!
Highly competent support. Well advised all round.
Chris knows how to solve a problem. Quality has a name: wunderwerk.io
We had the wunderworkers develop bespoke industrial software for creating recipes for a highly sensitive industrial process.
The collaboration was extremely professional from the outset: the team quickly understood our complex requirements, implemented them precisely and always paid close attention to maximum reliability and security. I would particularly like to highlight their technical know-how, clean documentation and fast response times for questions or change requests.
The recipe editor is now running in several plants in Sweden, Italy and the Czech Republic.
The software runs reliably, is intuitive to use and our customers are completely satisfied. We can recommend wunderwerk without reservation!
wunderwerk built a digital solution for my photography business that has been running stably and reliably for years. The support is top-notch, reliable and competent. I can only recommend them.
Christoph Niedermoser and his team impressed us with their professionalism, precision and reliability, both in the consulting phase and in the implementation that followed.
Our requirements were implemented perfectly, and the GPS tracking system has now been in successful use in several of our facilities for a number of years.
Chris and his team gave me superb advice on my app idea. Uncomplicated, fast and professional! Highly recommended!
We have already implemented and completed several projects together over the past few years.
Professional implementation and personal contact.
Highly recommended!
Perfect implementation of our
billiards platform.
A very pleasant collaboration. It was fun! Highly recommended!
Why us?
What else is on your mind?
Many projects touch more than one topic. Here are the other areas in which we support businesses.
Don’t wait until someone exploits it.
The attacks are automated and don’t hit the big names first, but anything that is reachable. In a 30-minute initial consultation we clarify where your PHP application stands and what still needs to be done today.
Frequently asked questions about PHP2Shell and old PHP versions
Question not listed? We will answer it directly with the managing director in the free initial consultation.
What is PHP2Shell?
PHP2Shell is the name for two critical vulnerabilities in the PHP core (CVE-2026-109618 and CVE-2026-109619), published on 21 October 2026. They allow attackers to run their own code on the web server without logging in and affect all PHP versions since 5.4. An exploit is public, and attacks are automated. wunderwerk helps companies whose PHP applications are affected with immediate measures, updates and migration to a supported PHP version.
Which PHP versions are affected by PHP2Shell?
All PHP versions from 5.4 to 8.5 are affected by PHP2Shell. The vulnerability is only fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (as of 22 October 2026); php.net shows which versions still receive security updates. For PHP 7.4, 8.0 and 8.1 the PHP project has only published unsupported source-code backports, and some Linux distributions ship patched packages. There is no fix for PHP 5.4 to 7.3. In the PHP emergency check, wunderwerk checks which version is actually running on your systems, in every process, not just on paper.
Our application runs on PHP 7.4 or 8.1. What should we do?
With PHP 7.4 or 8.1, the first step is to check whether your hosting provider or Linux distribution ships a patched package, and to install it immediately. If there is none, the application has to be secured (block the attack vector, restrict access, monitoring) and migrated to PHP 8.3 or 8.4 soon. wunderwerk takes care of both: the immediate measures within a few days, then the migration as a project with a cost range. You can get an initial assessment via the form or in the initial consultation.
Is a web application firewall or Cloudflare enough?
No, a web application firewall or Cloudflare does not protect against PHP2Shell permanently. WAF rules block known attack patterns and buy time, but they do not replace an update, because attackers adapt their patterns. Disabling individual PHP settings does not fully close the vulnerability either. wunderwerk uses such measures as a stopgap and works on the actual fix in parallel: a supported PHP version.
How do we know whether our system has already been attacked, and what does that mean under the GDPR?
Only a compromise check shows whether a system has already been attacked, because an update does not undo a break-in that has already happened. In the PHP emergency check, wunderwerk checks web server and PHP logs for the known attack patterns, searches the file system for unfamiliar files and web shells, reviews cron jobs, user accounts and outgoing connections, and compares the code with the known state. If we find traces, we discuss the next steps with you, including the notification obligation under the GDPR: if personal data is affected, a personal data breach generally has to be reported to the data protection authority within 72 hours (Art. 33 GDPR).
How much does the PHP emergency check cost?
The PHP emergency check from wunderwerk has a fixed price that depends on the size of the application and the number of systems. You are told the price before work begins. It includes the inventory, compromise check, immediate measures and a written report with a roadmap and cost range for migration or takeover. The migration itself then takes place in modules that you approve individually. wunderwerk does not quote flat prices without having seen the system, but gives you a binding range before every step.
How quickly can you help?
wunderwerk answers enquiries sent via the form on the same working day, and the initial consultation takes place at short notice. Depending on scope, the PHP emergency check takes a few days, and we put immediate measures in place during it as soon as access is available. Migration to a supported PHP version takes weeks to a few months, depending on the state of the code; the application stays secured and in operation throughout.
Do you take over PHP applications built by another developer?
Yes, wunderwerk takes over PHP applications built by other developers; it is one of our most common cases. The prerequisites are access to the source code, server and database, as well as the rights to the code. We familiarise ourselves with the system, document it, secure operations and then take over maintenance and further development. If the source code is held by a previous provider or hosting provider, we help you obtain it. We do not run down tools or predecessors: software that has grown over time is rarely bad; it has simply got on in years.
Which PHP frameworks and systems can you migrate?
wunderwerk migrates Drupal, as well as custom applications without a framework, Laravel, Symfony, CodeIgniter, CakePHP, Zend Framework, Yii and Slim, and the portals, shops and internal systems built on them. Drupal has been part of our work for over 15 years, from Drupal 6 and 7 to Drupal 11, including migrations and custom modules. For simple website builders and standard CMS, your hosting provider or web agency is usually the faster point of contact; if they contain custom extensions, we are happy to take a look. We do not take on .NET projects for ongoing maintenance.
We have a Drupal website or a Drupal portal. Can you help with that too?
Yes, Drupal has been a focus at wunderwerk for over 15 years. PHP2Shell affects every Drupal version because the vulnerability is in the PHP core. If your site runs on Drupal 10 or 11 and PHP 8.2 or later, the update is quickly installed. Drupal 7 has been without support since January 2025 and usually runs on an old PHP version with no patch; here we secure it first and then migrate to Drupal 11, including content, users, permissions and custom modules. We also take over portals with Drupal as the back end and a custom front end.
Our application runs on PHP 5. Is a migration still worthwhile?
Only an analysis shows whether migrating a PHP 5 application is worthwhile: often it is, sometimes a rebuild is more economical. What matters is the scope and condition of the code, the business value of the functions and data, and what a new development would cost. wunderwerk compares both routes in terms of cost, duration and risk and recommends the one that pays off. Either way, we take the application out of the firing line immediately and secure your data before that decision is made.
Can you also host and look after the application afterwards?
Yes, after the fix wunderwerk hosts and looks after PHP applications in the EU, with monitoring, backups, ongoing security updates and support, or in your own infrastructure if you prefer. Updates for PHP, framework and libraries are installed and tested in step with the releases, so that the next critical vulnerability is a routine task. We have looked after many of our clients this way for over ten years.
Why wunderwerk for PHP2Shell and PHP migration, and do you also work on site?
wunderwerk brings over 20 years of project experience from more than 80 projects, PHP applications included, and has supported many clients for more than ten years, including several generations of their systems. The small, well-coordinated development team is based in Tyrol, Salzburg, Vienna and Berlin and works for companies in Austria, Germany and Switzerland, remotely and on site. You talk directly to the managing director, get a cost range before every step and end up with an application that will not become an emergency again in two years.