ExpertOverflowSecurity notice · Updated 21 Oct 2026
Two critical flaws in PHP can let an attacker run code on a web server without logging in. PHP shipped fixes on 21 October, and attacks were reported the same day.
Fix now · Pay later
$0due today
Nothing is charged until your site is fixed.
First come, first served. Final quote after we look.
Are you affected?
Any site serving pages with PHP below the fixed release for its branch is in the affected range. That includes WordPress and WooCommerce sites. PHP 8.1 and older are end of life and have no official fixed release, so the way out is an upgrade.
PHP’s advisory is plain: updating PHP is the only complete fix. A firewall buys time. It doesn’t replace the update.
| PHP branch | Fixed in | Support |
|---|---|---|
| 8.5 | 8.5.12 or later | Active support |
| 8.4 | 8.4.27 or later | Active support |
| 8.3 | 8.3.36 or later | Security fixes only |
| 8.2 | 8.2.35 or later | Security fixes end 31 Dec 2026 |
| 8.1 and older | No fixed release | End of life. Upgrade needed. |
In WordPress: Tools → Site Health → Info → Server. Some Linux distributions ship the fix under an older version number, so we confirm before we change anything.
What we do
Your site, your name, your email. We run a passive check of what your server advertises and email you straight away.
We update PHP to a fixed release, harden WordPress and the server, and put a firewall in front of your site.
Move to our managed hosting when you’re ready. You’re charged after the fix, never before it.
First come, first served. We work the queue in sign-up order.
Estimates
from $349one-time, when you move to our hosting
We match itwhat you pay your current host, per site
Nothing is charged until your site is fixed. We put a card on file before we start and charge it after the work is done.
Staying on your current host? We can patch in place when your host offers the fixed PHP, usually from $549. Some hosts haven’t released it yet, and then moving is the fastest way to get patched.
The long-term fix: a headless rebuild, from $4,200. You keep editing in WordPress, but visitors only ever see a fast static site, with no PHP exposed to the internet.
Get in the queue
Sign up now. We fix it now. You pay later. First come, first served.
You’re in the queue
Check your inbox for an email from signups@expertoverflow.com. We’ll reply shortly to collect a few details and book a time. Nothing is charged now.
What your server shows publicly
A passive check only reads what your server reports to any visitor. We confirm everything once we have access.
After you sign up, our team (AI-assisted) emails you, gathers what we need and books a time. Before we touch anything, you confirm a short work authorization and put a card on file. It isn’t charged until the work is done.
Questions
No. Signing up is free. Before we start, you confirm a short work authorization and put a card on file. We charge it only after your site is fixed, at the quote you approved.
No, and we will never ask for them by email. When we need access, we’ll ask you to invite us or delegate access through your host or WordPress. You stay in control and can remove us at any time.
Good. Many hosts are rolling out the fix. We’ll confirm your PHP version, then either harden the site anyway or tell you you’re fine.
Yes, if your host offers the fixed PHP. Patching in place takes more work, so it usually starts at $549. Some hosts haven’t released the fixed PHP yet; if yours hasn’t, moving to our hosting is the fastest way to get patched.
We roll out PHP security fixes the day they ship, we match what you pay your current host, and moving the site is included with the fix. You can cancel anytime.
A headless rebuild. Your team keeps editing in WordPress, but visitors only ever see a fast static site, so there’s no PHP on the public internet to attack. Rebuilds start at $4,200.
Only what your site shows any visitor: response headers such as an advertised PHP version, and the WordPress details a public page lists. It’s a passive check. We never attack, scan for weaknesses or probe your site.