PHP Site AuditTHE PHP AUDIT FIELD GUIDE
Clear answers.
Practical next steps.
Understand the risk, ask better questions of your host, and give your developer a useful starting point.
Published by PHP Site Audit, a Synorb Inc. service. Advice is scoped and source-cited; a guide cannot establish the patch status of your website.
PHP2Shell: what website owners need to know
A practical, nontechnical explanation of the October 2026 PHP2Shell vulnerabilities and the first steps for site owners.
Read guide ↗PatchingWhich PHP versions fix PHP2Shell? Check vendor backports carefully
The upstream PHP fixed releases, how distribution backports work, and what evidence to request from a hosting provider.
Read guide ↗VerificationHow to verify which PHP version actually serves your website
A safe evidence checklist for connecting the PHP CLI, web runtime, hosting panel, and a real deployment.
Read guide ↗WordPressWordPress Site Health: what its PHP version can and cannot tell you
Use WordPress Site Health to find server details, while keeping PHP core updates separate from WordPress updates.
Read guide ↗OperationsPHP-FPM vs mod_php: what a runtime patch must reach
Why PHP deployments can run more than one serving process and why a successful package update still needs runtime confirmation.
Read guide ↗PHP securityWhy PHP recommends disabling session upload progress after PHP2Shell
The scope and limits of PHP's session.upload_progress.enabled mitigation, including configuration and restart considerations.
Read guide ↗PHP securityCVE-2026-115560: what PHP's October 23 session advisory actually says
A careful summary of PHP's informational notice about an uncommon session serialization configuration and upload progress.
Read guide ↗Assessment limitsWhat a public PHP security check can and cannot prove
Understand what public HTTP checks reveal and why they cannot certify the PHP runtime or a whole website as safe.
Read guide ↗VerificationA PHP version banner is a clue, not a vulnerability verdict
Why public version headers can be missing, stale, or backported, and how to verify the server-side fix instead.
Read guide ↗HostingWhat to ask your host to confirm a PHP security patch
A concise checklist for shared hosting and managed PHP sites when the provider controls runtime updates.
Read guide ↗OperationsHow to stage and verify a PHP security update
A practical deployment sequence for applying a PHP runtime patch with a focused compatibility and health check.
Read guide ↗OperationsPHP2Shell developer handoff: evidence to include in the ticket
A practical handoff template for assigning PHP runtime patch work across hosting, development, and security teams.
Read guide ↗E-commercePHP security update checklist for online stores
A focused plan for store owners to coordinate the PHP runtime patch and verify customer-facing commerce workflows.
Read guide ↗Incident responseIf you suspect a PHP website was compromised: first response steps
A measured first-response checklist that separates patching, evidence preservation, containment, and incident conclusions.
Read guide ↗Web security basicsPHP site security headers: what a missing header means
A practical guide to interpreting HTTPS, HSTS, CSP, framing, and content-type headers without treating them as a security score.
Read guide ↗Web security basicsPHP site cookies: Secure, HttpOnly, and SameSite in context
What common session-cookie flags do, what they do not do, and how to review them without guessing from one response.
Read guide ↗PHP operationsRemove public PHP debug pages before they expose server details
Why phpinfo and development diagnostics should not be left reachable on production websites.
Read guide ↗PHP maintenanceHow PHP support dates should shape your upgrade plan
Use the PHP project's branch lifecycle to plan security updates and migration work before a branch stops receiving fixes.
Read guide ↗MethodologyWhat an external PHP website assessment checks
A plain-language scope guide to public response, TLS, headers, technology clues, and the limits of automated external review.
Read guide ↗Security newsPHP2Shell news: separate confirmed fixes from headlines and claims
How to read evolving coverage of PHP2Shell by prioritizing project advisories and separating scanning activity from confirmed compromise.
Read guide ↗WordPress and ecommerceWill updating WordPress plugins fix PHP2Shell?
Understand the difference between WordPress, WooCommerce and plugin updates and the PHP runtime patch PHP2Shell requires.
Read guide ↗Hosting and runtime checksHow do I check my PHP version in cPanel or Plesk?
Find the PHP version assigned to a website in a hosting panel and avoid confusing it with a command-line runtime.
Read guide ↗Hosting and runtime checksWhat should I ask my shared host about PHP2Shell?
A practical support request for shared-hosting customers who cannot inspect the PHP package or restart workers themselves.
Read guide ↗Deployment and operationsHow do I patch PHP2Shell in a PHP container?
Trace the PHP runtime to its container image, rebuild and redeploy the right artifact, then verify running workloads rather than only the source tag.
Read guide ↗Hosting and runtime checksHow should Windows and IIS sites update PHP for PHP2Shell?
A Windows hosting checklist that distinguishes IIS FastCGI, command-line PHP and the exact runtime build serving requests.
Read guide ↗Security researchWhat does it mean that AI helped discover PHP2Shell?
A measured explanation of AI-assisted security research, the PHP2Shell disclosure, and why AI claims do not replace vendor evidence.
Read guide ↗PHP securityIs PHP2Shell the same as the old PHP-CGI vulnerability?
Compare the October 2026 PHP-core flaws with CVE-2012-1823 without confusing distinct causes, affected configurations or fixes.
Read guide ↗Incident responseMy PHP site looks normal. Could it still be vulnerable or compromised?
Learn why normal pages and clean-looking dashboards cannot establish PHP patch status or rule out an earlier compromise.
Read guide ↗Deployment and operationsWhat should I back up before a PHP security update?
A practical backup and rollback plan for PHP runtime updates that protects site data without reverting indefinitely to an unpatched build.
Read guide ↗Hosting and runtime checksHow do I check every PHP site in a hosting account?
Build a practical hostname-to-runtime inventory so one patched site does not hide another PHP application or worker still using an old build.
Read guide ↗