Your website runs on PHP. Two critical flaws now let anyone run code on it.
Every WordPress, Drupal, Joomla and custom PHP site is in scope, and your login page cannot stop it. VICOSYS in Hong Kong checks your exposure within one working day, then patches, upgrades or rebuilds the site so it stays fixed.
Is your site affected? Check your PHP version.
Do not know your version? Most owners do not. It is the first thing we check, and we tell you in writing.
PHP 8.2, 8.3, 8.4 or 8.5
Patch available: 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Update, restart every PHP worker, confirm with a scan.
PHP 7.4, 8.0 or 8.1
No official PHP release. Some hosts and Linux vendors ship backports. Many do not. Upgrading to 8.3 or 8.4 is the dependable fix.
PHP 7.3 or older
No fix exists. The only remedy is a PHP upgrade, and most sites this old need their CMS, theme and plugins upgraded with it.
Why your security plugin, firewall rules and login page do not cover this
It runs before your site does
PHP processes the malicious request before WordPress, Drupal or your application code loads. Logins, roles and security plugins never see it.
A settings change does not close it
PHP’s own advisory says no configuration change fully mitigates the flaws. Only a patched PHP version does.
Every setup is in scope
Apache with mod_php, PHP-FPM, php-cgi, LiteSpeed and FrankenPHP are all affected. Shared hosting, a VPS and a dedicated server alike.
Attackers already have it
Security researchers reported exploitation attempts from the day the patch shipped. Government CERTs in the US and Canada have told organisations that cannot update to take PHP sites offline until they can.
Patch, upgrade or rebuild. We tell you which, with the cost next to it.
Patch
For sites already on PHP 8.2 or newer, on a host that lets us control the PHP version. We apply the fixed release on a staging copy, run the site through its critical paths, roll it to production, restart every worker and confirm it with a security scan report.
Upgrade
For sites where a jump to PHP 8.3 or 8.4 will break an old theme or plugin. We audit the CMS, theme and plugins for PHP 8 compatibility, fix or replace what breaks, upgrade PHP and the CMS together on staging, test, then move production. A security scan report at the end, in your inbox.
Rebuild
For sites with no patch, or any site where the upgrade quote is more than half the cost of a new one. A new site on current WordPress, Drupal or Next.js, on our Hong Kong servers, with PHP patching, monitoring and backups included under a care plan. Your content and Google rankings carried across with redirects.
From “are we affected?” to fixed and scanned.
Not sure which option is you? That is what the free check is for. We come back with the row you are in, the option we recommend and a fixed quote.
Send us the site address and, if you have it, your hosting provider’s name. Written answer within one working day.
We clone the site to staging and apply the fix there first. If the update breaks the checkout or the contact form, you never see it.
Patch, upgrade or rebuild, agreed in advance at a fixed price. Production is updated in a window you choose, with a tested backup taken first.
A security scan of the live site, the scan report in your inbox, and the PHP worker restart that most DIY patches forget.
The team Hong Kong’s public bodies trust with their security findings
Since 2007, in Hong Kong
We have upgraded PHP on sites we built and sites we inherited through every major version since PHP 5.
Security remediation is routine work for us
SRAA and security-scan findings fixed and re-tested for RTHK, West Kowloon Cultural District, Hong Kong Science and Technology Parks and government recruitment platforms.
Our own servers
A Hong Kong datacenter we run ourselves, so the PHP version is ours to control and there is no upstream ticket to wait on.
Staging before production
Every update is tested on a copy of your site first.
An SLA in writing
Response times by severity, in the contract.
Trusted by
The next PHP advisory should be a routine Tuesday
SEE CARE PLANS IN FULLPHP ships security releases several times a year. Under a VICOSYS care plan, patching is scheduled, tested on staging and done before you read about it. Monitoring has a human on the alerts, backups are restored as a test, and you get a quarterly review of speed, SEO and what to improve next.
Essential
Patching, monitoring, backups and a next-business-day response. For brochure sites that need to stay safe and up.
Business
Everything in Essential, plus monthly change hours, same-day response and a quarterly improvement review.
Enterprise
Priority SLA with emergency response, dedicated hours, staging environment and named engineers.
FAQ
We use WordPress with a security plugin. Are we still affected?+
Yes. The flaw is in PHP itself, underneath WordPress. The request is handled before WordPress or any plugin loads, so nothing at the application level can block it. The fix is a patched PHP version.
Our hosting company says they have patched. Is that enough?+
Often, yes, for sites on PHP 8.2 or newer. Ask them two things: which exact PHP version your site now runs, and whether the PHP workers were restarted. If your site is on 8.1 or older, a host-level patch is a vendor backport at best, and we would confirm it with a scan before relying on it.
Can you just upgrade PHP without touching the site?+
On a modern site, usually. On a site built for PHP 7, a jump to 8.3 or 8.4 commonly breaks the theme or one or two plugins. That is why we test on staging first and quote the compatibility fixes before anything changes on production.
How long does it take?+
The exposure check comes back within one working day. A patch is typically done the same week. An upgrade depends on how much breaks on staging, and we give you the timeline with the quote. A rebuild is a normal web project, and we can patch or isolate the old site while it is in progress.
Our developer is gone and we have no admin access. Can you still help?+
Yes. Recovering access to hosting, DNS and the CMS is a normal first step for sites we inherit. We start from whatever you have: a domain name and an invoice from the host is usually enough.
What does the check involve? Do we need to give you passwords?+
Not to start. We work from the public site and your host’s name first. If we need hosting or CMS access to confirm the version, we ask for a temporary account and tell you when to remove it.
Do you provide a report we can give to our auditor or head office?+
Yes. You receive the security scan report after the fix, and on request a short written summary of the versions before and after, what was changed and when.
We were told to take the site offline. Should we?+
If you run PHP 8.1 or older and cannot update today, CISA’s advice is to take the site offline or put it behind a web application firewall until it is fixed. Call us first. In many cases we can patch or isolate the site within the day, which is better than days of downtime.
Find out today whether your site is exposed.
Send the address of your website. Within one working day you get the PHP version, which row of the table you are in, and a fixed quote for the fix we recommend.