Website emergency

PHP2Shell: is your website exposed?

Have the risk assessed, even without your credentials. Lost your access? Your agency or hosting provider cannot be reached? ICTCG can start by examining the clues visible from the outside, with your authorisation, then deepen the diagnosis as soon as access becomes available.

Request my diagnosis How it works

Alert: a flaw already exploited at scale

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) affects the PHP engine used by a large number of websites. Fixed versions have been available since 21 October 2026. The Centre for Cybersecurity Belgium recommends patching immediately, or otherwise taking the site offline.

9.2/10
severity score of the two critical flaws (php.net, 21/10/2026): Millions
of attack attempts, according to Cloudflare (Matthew Prince, 22/10/2026)

What you get

No password needed to start

A first external assessment of your exposure to PHP2Shell.

A quick first opinion

Risks identified, no detectable clue, or a situation that cannot be determined at this stage.

An in-depth check afterwards

Confirmation of versions and patches with the appropriate access, then a remediation proposal if needed.

Are you affected?

PHP2Shell concerns the PHP engine used by many websites, including WordPress and PrestaShop. From the outside, version or exposure clues are sometimes visible, but a hosting provider may have applied the fix without changing the displayed version number; a proxy may also hide PHP. WordPress access is generally not enough to apply the fix on the server.

Your site runs on WordPress, PrestaShop, Drupal or Joomla

These applications run on PHP: it is the PHP version of your hosting that must be patched, not only the site.

You do not know who manages PHP, the server or the hosting

Agency gone, provider unreachable, access lost: we help you identify the right contact, with your authorisation.

You received an alert from your host or noticed something unusual

Security message, slow or altered site, unexpected page: mention it in your request; a suspected compromise is forwarded to a qualified person.

Two steps, one diagnosis

Step A — without technical access
After checking your entitlement and obtaining written authorisation, ICTCG examines the site's public information and, within the agreed scope, may perform non-destructive checks. Outcome: “risk identified or strongly suspected”, “no risk indicator detected (inconclusive)” or “situation undetermined”.
Step B — as soon as access is available
Check of the PHP version actually running, of the installed patches and of the configuration, with a report and recommendations. Any remediation is quoted separately.
One price for both steps
The €199 excl. VAT fee covers both steps of the diagnosis, the second being carried out once access is obtained. The amount is deducted if ICTCG then performs the remediation.
What an external diagnosis cannot tell
A diagnosis from the outside generally cannot confirm that a site is patched, nor prove that it does not use PHP. The absence of a detected clue does not mean the absence of a vulnerability. No exploitation that could disrupt the site is included in the external assessment.

Two-step PHP2Shell diagnosis: €199 excl. VAT

You can start without credentials. Amount deducted if you then entrust us with the remediation.

Remediation, if needed, is quoted after the diagnosis.

Request my diagnosis

How does it work?

1. Your request
You tell us your website and a way to reach you.
2. Scope and first assessment
We confirm the scope and the authorisation with you; we carry out a first assessment from the outside, without any password.
3. In-depth diagnosis
If external information is not enough to conclude, we continue the diagnosis with the necessary access once it is available.
4. Next steps
If a risk or a necessary remediation is identified, we propose the next steps on quotation or coordinate with your hosting provider.

Request my PHP2Shell diagnosis

No password to share to get started. Even if you do not know who manages your site, you can contact us.

No password
Do not include any password in your message. If access is required later, we will arrange a secure, temporary hand-over.
What helps us
Your website address, your hosting provider if you know it, who usually looks after the site, the access you have (its type only, never a credential) and any alert you received.
Your entitlement
Before any check, we confirm with you in writing that you own the site or are entitled to request an assessment, as well as the agreed scope.
Reply by e-mail
We get back to you by e-mail to clarify your situation and organise the next steps.

Request my diagnosis

Request my PHP2Shell diagnosis

No password to share to get started. Even if you do not know who manages your site, you can contact us: we get back to you by e-mail.

Your website address

Your e-mail address (for our reply)

Phone (only for an urgent intervention)

Name

Company

Hosting provider, if you know it

Who usually looks after the site?

Did you receive an alert or notice a problem?

Useful details

Message from your host, anomaly noticed, context: anything that helps us, without any password.

I own this website or I am entitled to request an assessment for it.

Before any check, we confirm your entitlement and the agreed scope with you in writing.

Do not include any password in this form. If access is required later, we will arrange a secure, temporary hand-over. Your data is used only to handle your request: legal notice and privacy.

Your answers are only used to handle your request: they reach us by e-mail through our sending provider (Amazon Web Services) and are not stored on the website. Privacy

Official sources

Advisories from authorities and vendors, to be read at the source.

Centre for Cybersecurity Belgium (CCB)

Warning: patch immediately, or otherwise take offline.

PHP2Shell: is your website exposed?

No password needed to start

A quick first opinion

An in-depth check afterwards

Your site runs on WordPress, PrestaShop, Drupal or Joomla

You do not know who manages PHP, the server or the hosting

You received an alert from your host or noticed something unusual

Step A — without technical access

Step B — as soon as access is available

One price for both steps

What an external diagnosis cannot tell

1. Your request

2. Scope and first assessment

3. In-depth diagnosis

4. Next steps

No password

What helps us

Your entitlement

Reply by e-mail

Centre for Cybersecurity Belgium (CCB)

PHP — fixed versions of 21/10/2026

CERT-FR — alert CERTFR-2026-ALE-014

Cloudflare — web application firewall protections

Wiz Research — PHP2Shell analysis

NCSC-NL — PHP2Shell information

PHP issues a follow-up advisory: a third flaw, fix to come

24 hours later: 99% of measurable servers still vulnerable

Millions of attack attempts

France: CERT-FR alert (CERTFR-2026-ALE-014)

1.57 million unpatched PHP servers

Belgium: advisory from the Centre for Cybersecurity (CCB)

The NSA and the CERTs: “update, or take offline”

Fixes released: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12

Cloudflare enables web application firewall rules before the release

Public leak and announcement of a critical update

First attack attempt observed, 4 days before the release

Private report to the PHP security team

Wiz Research finds the flaw independently

Discovery of the first flaw by Calif