PHP2SHELL · Every version needs a check

Your PHP website can be broken into right now

Running WordPress, WooCommerce, OpenCart, or Magento? Those sites run on PHP, so this vulnerability affects you too. Send us your website and we will tell you what to do within 24 hours.

WhatsApp us your website See websites we have built

Avg response < 4 hrs · WhatsApp / email

Hong Kong-based team24-hour reply6-month post-launch support

How serious

Your shop can go offline, and customer data can leak, before you are ready

Checkout, bookings, the admin, and the public pages all run on the same PHP. If someone else takes control of it, the website is no longer yours.

Orders can stop the same day

Shop · today

TradingStopped

CheckoutHalted
BookingsHalted
New orders0 today
AdminLocked
Public pageNot yours

Checkout, bookings, the admin, and the pages your customers see all run on the same PHP. Someone else can take control of it before you have time to plan, and the shop stops taking orders.

Customers cannot place an order or book
You and your staff cannot sign in
Search results and customers see a shop that will not open
That week goes to saving the website, not running the business

Customer data can be taken

Records in reach

Customer fileNames, phones, addresses
OrdersHistory and totals
UploadsFiles customers sent
ConfigDatabase login
StaffAdmin accounts

Anyone who controls this PHP can take what the website holds: customer details, orders, and uploaded files.

Names, phone numbers, and addresses
Orders and files your customers uploaded
Staff logins
Telling customers afterwards, and repairing your reputation, usually costs more than fixing it now

Every version

Do not assume a newer version is safe. It can be affected too.

Every website still running PHP is affected. That includes a site built last year, one that has been online for years, and one your host calls already up to date.

01
Newer PHP 8 sites
You are only patched on the four releases from 21 October: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Anything older on PHP 8 is still exposed.
02
PHP 7 and PHP 5
PHP no longer publishes fixes for these. There is no update button that closes this.
03
You cannot tell from the homepage
The homepage, the admin, and the plugin list will not show it. A site that loads is not necessarily patched. Your host's “latest PHP” is often not the 21 October release.

Assume your website is unpatched until it is checked

Send us your website and we will check it for you.

Two solutions

Two different solutions for you to choose

You do not need to know which one fits. Send us your website and we will tell you.

Path · try the jump

Now

5.6

Target

8.5.12

CodeLow compatibility
MySQLNot compatible
OutcomeMay fail
Use whenComplex · lots of data
TimeAbout 1 week

If your website is fairly new, we apply the update and you keep trading

This is for a site already on a recent version of PHP. We test checkout and the admin on a copy first, then move you to the 21 October update. We are not building a new website. Your live site stays as it is until that test passes.

Test checkout and the admin on a copy first
Then move to the 21 October update
This is not a new website
Your live site stays unchanged until the test passes
You do not need to look up the version

Patch my website

Path · recreate

Features
Kept
Interface
Kept
Data
Kept

Recreated on

Next.js + Node

Use whenSimple · straightforward
Compared with a jumpFaster and easier
Time2–3 weeks

If your website is old, we rebuild it and keep what you already have

This is for PHP 5 and PHP 7 sites that have sat unchanged for years. There is often no patch to install. A simple site is faster to rebuild in Next.js, usually two to three weeks. A complex site with years of data is tried as an upgrade first, for about a week. If that does not work, we stop. We will not break the shop you have now, and we rebuild it instead. The rebuild follows your current website. It is not a new template dropped on top.

For PHP 5 and PHP 7 sites left unchanged for years
A simple site: rebuild it in Next.js in about two to three weeks
A complex site: try an upgrade for about a week, and stop if it fails
Built from your current website, not from a template

Rebuild my website

Why act now

The news is already out. If you wait, the vulnerability stays open.

A fix has been released. That does not mean your website is already using it.

There is no quick workaround

A new password, a plugin update, or a reinstall will not close this hole.

A new password will not close it
A plugin update will not close it
Reinstalling the shop will not close it

Message us on WhatsApp

Where the bug lives

WordPress / Laravel

Plugins current

Patched

Your application

This release

Patched

PHP interpreter

php2shell

Exposed

Shop and records

Same process

Exposed

The fix only came out on 21 October

If your website is not on that update yet, the vulnerability is still open.

PHP 8 from before 21 October is still affected
“Latest PHP” from your host is often not this update
A working homepage does not mean you are patched

Ask us to check your website

php2shell · fixed releases

LineBeforePatched

8.5≤ 8.5.118.5.12
8.4≤ 8.4.268.4.27
8.3≤ 8.3.358.3.36
8.2≤ 8.2.348.2.35

8.1 and older have no official update. PHP 5.6 is not a patch — see the two paths.

Waiting until December makes the job bigger

PHP 8.2 also stops getting official updates at the end of 2026. Leave it until December and there is more to fix, not less.

PHP 8.2 is supported until 31 December 2026
The longer you wait, the more has to change
Fixing it now is easier than doing everything in December

Talk to us on WhatsApp

Upgrade path

01
Inventory
Version, SAPI, extensions
Live, read only
02
Staging
Target release, off production
Copy
03
Regression
Checkout, login, the order path
Copy
04
Cutover
Only after the pass
Live

Fix it while your shop is still open

If you wait until something goes wrong, the shop stops first and your customers hear about it first. Do it now, while you are still taking orders.

Fix it while you can still take orders
You do not have to warn customers first
An engineer replies within 24 hours

WhatsApp StarsNet

Version report

Example report8.1.29 → 8.3.36

WordPressCore + must-use
LaravelFramework + packages
Custom PHPApplication code
MySQLWhether the jump can land
HostingcPanel · CloudLinux · distro

What you get

You do not need to understand PHP. You need the shop to stay open, and your data to stay yours.

Within 24 hours we tell you if you are at risk, whether to patch or rebuild, and what we would change
We do not touch the live website first. We test orders, bookings, and the admin on a copy, and switch over only after that passes
If the site is too old to patch, we rebuild it. Customers keep the same features, the same look, and their existing data
At the end you get a plain note: what it was, what it is now, and what we tested
You do not have to log in to your host, or look up a version number

Why StarsNet

Your host can change the PHP version. We make sure the shop can still take payment afterwards.

Your host can give you an update button. They will not first check that checkout, bookings, and the admin still work. Someone who only changes the version may try that on the live site. We test payments on a copy and switch over only after that passes. If the site is too old, we rebuild it and keep the features, the look, and the data. An engineer replies within 24 hours. We are a registered vendor of the Hong Kong Productivity Council, and a Category A subcontractor under the Hong Kong Government's Standing Offer Agreement for IT services, for projects from HK$3 million to HK$20 million.

We test first, then we switch. The live website is not the test
We both patch and rebuild, so you do not need a second company
An engineer replies within 24 hours, not an automatic message

WhatsApp StarsNet

Accreditations & Recognition

Our Company

Trust Registry02 EntriesVerified · Active

0102Registry entry

HKSAR · HKPC

Hong Kong Productivity Council - Registered Vendor

We offer comprehensive web development solutions that incorporate ESG factors and concepts to enhance corporate productivity, business efficiency, and cost savings. Our solutions aim to help businesses maintain a competitive advantage in both local and international markets.

Classification: Registered IT Vendor
Scope: Productivity · ESG · Cost reduction

0202Registry entry

OGCIO · SOA5

Standing Offer Agreement for Quality Professional Services - Cat A Major Subcontractor

As a qualified Information Technology professional subcontractor under the Standing Offer Agreement 5 ('Agreement 5'), we possess the capability to undertake projects with contract values of HKD $3 million or above, but not exceeding HKD $20 million.

Classification: Cat A Major Subcontractor
Scope: HK$3M – HK$20M projects

Has this vulnerability been closed on your PHP website?

Message us on WhatsApp Send your website

Your host can change the PHP version. We make sure the shop can still take payment afterwards.

Your PHP website can be broken into right now

Your shop can go offline, and customer data can leak, before you are ready

Orders can stop the same day

Customer data can be taken

Do not assume a newer version is safe. It can be affected too.

Newer PHP 8 sites

PHP 7 and PHP 5

You cannot tell from the homepage

Assume your website is unpatched until it is checked

Two different solutions for you to choose

If your website is fairly new, we apply the update and you keep trading

If your website is old, we rebuild it and keep what you already have

The news is already out. If you wait, the vulnerability stays open.

There is no quick workaround

The fix only came out on 21 October

Waiting until December makes the job bigger

Fix it while your shop is still open

You do not need to understand PHP. You need the shop to stay open, and your data to stay yours.

Your host can change the PHP version. We make sure the shop can still take payment afterwards.

Just send your website

Our Company

Hong Kong Productivity Council - Registered Vendor

Standing Offer Agreement for Quality Professional Services - Cat A Major Subcontractor

Has this vulnerability been closed on your PHP website?

Your PHP website can be broken into right now

Your shop can go offline, and customer data can leak, before you are ready

Orders can stop the same day

Customer data can be taken

Do not assume a newer version is safe. It can be affected too.

Newer PHP 8 sites

PHP 7 and PHP 5

You cannot tell from the homepage

Assume your website is unpatched until it is checked

Two different solutions for you to choose

If your website is fairly new, we apply the update and you keep trading

If your website is old, we rebuild it and keep what you already have

The news is already out. If you wait, the vulnerability stays open.

There is no quick workaround

The fix only came out on 21 October

Waiting until December makes the job bigger

Fix it while your shop is still open

You do not need to understand PHP. You need the shop to stay open, and your data to stay yours.

Your host can change the PHP version. We make sure the shop can still take payment afterwards.

Just send your website

Our Company

Hong Kong Productivity Council - Registered Vendor

Standing Offer Agreement for Quality Professional Services - Cat A Major Subcontractor

Has this vulnerability been closed on your PHP website?