Urgent PHP update needed? We update your server and your PHP code.

Two critical PHP vulnerabilities threaten unprotected servers.

The security updates are available. However, for older websites, online shops and custom-built applications, a version change can cause considerable compatibility problems.

CxP takes care of both: we install the required PHP security update and adapt your existing code if it no longer works with the new version. This means you do not have to choose between an unprotected server and a website that stops working after the update.

  • Install current PHP security updates
  • Make outdated PHP code compatible
  • Check functionality and availability after the changeover
Request PHP update now → +49 5522 3175515available daily 10 am – 9 pm
Done ourselves — on 21 October 2026

This website is up and running. Our own high-traffic portal motorradundreisen.de and all client websites we look after were brought onto the patched version PHP 8.3.36 on 21 October 2026, the very same day — without being taken offline. That is exactly what we offer you.

Request PHP update now

Briefly describe your website or application. We will clarify which update is required.

Your details go only to us and are neither published nor passed on. Privacy

Security situation

Can your website stay online safely?

On 21 October 2026, the PHP project confirmed two critical vulnerabilities and simultaneously released the security versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both vulnerabilities are rated with a CVSS v4.0 severity score of 9.2 and described as unauthenticated remote code execution: under certain conditions, an attacker does not need any credentials to execute code on the server.

According to the official description, PHP installations that serve web requests are affected — including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. The Dutch cybersecurity authority NCSC-NL maintains its own advisory directory on the two vulnerabilities, CERT-EU has issued an advisory, and other European bodies have done so as well. For companies, this is not a theoretical danger but a matter of unauthorised access to data, manipulated content and business interruptions.

On 21 October 2026, the German Federal Office for Information Security (BSI) issued a warning and stated in a press release that the security update was necessary on the same day. BSI Vice President Thomas Caspers considers large-scale exploitation within a few hours of the updates being released to be likely: “There is therefore an immediate need for action!”

The decisive question is therefore not only whether your server needs a PHP update, but also whether your website will still work afterwards. We help with both.

Request security update and code adaptation → +49 5522 3175515

Sources: BSI press release of 21.10.2026 „PHP: BSI warnt vor kritischen Schwachstellen – Sicherheitsupdate noch heute notwendig" and BSI cyber security warning 2026-297981-1032 · PHP security advisory of 21.10.2026 on php.net (CVE-2026-109618, CVE-2026-109619) · Advisory repository NCSC-NL/php2shell · Version and support status: php.net/supported-versions and php.net/eol.

Server and code

Update your PHP server and keep using your existing code

A PHP security update is not always done with a single click. Older websites and custom-built applications in particular depend on specific PHP versions, on extensions or on functions that no longer exist in newer versions. That is why we offer both halves together.

Service 1

PHP server updates

We take care of the technical update of your PHP server environment — from the initial assessment to the functional test after the changeover.

  • Determine the installed PHP version and operating mode
  • Install security updates and available patches
  • Move to a supported PHP branch
  • Update PHP-FPM and the server configuration accordingly
  • Check extensions and dependencies
  • Verify the web server integration
  • Prepare a backup and a rollback path
  • Test after the changeover instead of hoping
Service 2

Updating PHP code

Your software only runs on an old PHP version? We review the existing code and modernise it to the point where the version change becomes possible.

  • Replace removed PHP functions
  • Correct incompatible parts of the code
  • Clean up warnings and runtime errors
  • Establish PHP 8 compatibility
  • Review frameworks and libraries
  • Update dependencies
  • Adapt in-house scripts and custom software
  • Thoroughly test interfaces and business processes
You do not need a separate service provider for each half. We take care of the server environment and the application code — one point of contact, both problems solved.
Request PHP migration →
After the update

What happens if your website stops working after the PHP update?

A version jump creates work when the existing application is not compatible with the new PHP version. These are the consequences we regularly see in such cases:

  • The website only shows an error message or a blank page.
  • The online shop no longer accepts orders correctly.
  • Contact forms and registrations no longer work.
  • Custom-built modules run into errors.
  • Outdated extensions can no longer be loaded.
  • Individual important functions silently fail after the changeover.

That is exactly where we come in: we review the code base, find the incompatible sections and prepare the necessary adjustments before the changeover goes live. Where technically possible, we test beforehand in a separate environment. For larger installations, we plan the switch including backup and rollback path.

The goal is an update that holds — with as short an interruption as the respective system allows.

We do not promise guaranteed zero downtime, because it cannot be achieved on every system.

Klingt kompliziert? Ist es für dich nicht. Ein Anruf, und wir klären das in fünf Minuten.
+49 5522 3175515 Einfach beraten lassen
Plan a PHP update without nasty surprises →
Immediate help

Do I have to take my website offline because of the PHP vulnerability?

Not every website has to go offline. What matters is the PHP version in use, the operating mode, the server configuration and how quickly the security update can be applied. The PHP project recommends installing the available updates immediately.

If an immediate update is not possible, the PHP project lists interim settings — such as disabling session.upload_progress together with restarting the workers, as well as adjusted values for memory_limit and post_max_size. It explicitly makes clear that such measures do not make an installation secure but merely buy time. For particularly exposed systems, a temporary restriction or shutdown may be the right course of action as long as the patch is not yet in place.

The sooner the ability to update is established, the sooner operations run on a secured foundation again. We assess the situation on your server and implement what is necessary.

Request PHP security update → +49 5522 3175515
Version status

PHP 7.4, PHP 8.0 or PHP 8.1? Then more is needed than a patch.

Many websites and custom applications still run on older PHP versions. The problem is more fundamental than the current vulnerability: these branches no longer receive regular security updates from the PHP project. PHP 7.4 ended in November 2022, PHP 8.0 in November 2023, PHP 8.1 in December 2025. For the two current vulnerabilities, only backport branches exist for these versions — no regular support.

PHP 8.2 also reaches its end of support on 31 December 2026. Moving to a supported branch therefore makes sense not only because of this week. However, an older application does not automatically run on a newer PHP version — that is why we first review the source code and make the necessary adjustments.

Your application should keep working — on a current foundation.

As of 21 October 2026 per php.net. The security releases close CVE-2026-109618 and CVE-2026-109619. For 7.4, 8.0 and 8.1 the PHP project provides no regular fix, only backport branches or patches from individual distributions.
PHP branch Security release Status Support
PHP 8.5 8.5.12 Actively supported Security updates until 31.12.2029
PHP 8.4 8.4.27 Actively supported Security updates until 31.12.2028
PHP 8.3 8.3.36 Security fixes only Security updates until 31.12.2027
PHP 8.2 8.2.35 Security fixes only End of support 31.12.2026
PHP 8.1 no regular fix End of life Support ended 31.12.2025 (last 8.1.34)
PHP 8.0 no regular fix End of life Support ended 26.11.2023 (last 8.0.30)
PHP 7.4 no regular fix End of life Support ended 28.11.2022 (last 7.4.33)
Have your version checked →
Process

How your PHP update works

  1. Check PHP version and applicationWe determine which version is running in which operating mode, what needs to be updated and where compatibility problems are to be expected.
  2. Prepare the updateWe define the target version and plan the necessary code adjustments, the data backup and the changeover procedure — including a rollback path.
  3. Update server and codeWe install the security updates and adapt the incompatible parts of the code. Both in one go, so that nothing is left hanging in between.
  4. Test functionsWe check the processes that matter: ordering, forms, login, interfaces, background processes — and the logs afterwards.
  5. Deploy the updated applicationOnce the checks are complete, the changeover goes live. You receive a short overview of what was changed and what we recommend.
Who it is for

PHP security updates for websites, shops and custom applications

We update PHP-based systems of different types — and tell you in advance what the respective version and environment mean for CMS and shop systems.

  • Corporate websites
  • Custom-developed PHP applications
  • Older content management systems
  • PHP-based online shops
  • Customer portals and member areas
  • In-house administration software
  • Interfaces and background processes
  • Existing sites with outdated modules

Also for agencies and IT service providers who want to outsource migration work: we work in the background on server and code, while the client contact stays with you.

Frequently asked questions

PHP update and PHP vulnerability — frequently asked questions

Is my website affected by the current PHP vulnerability?
That depends on the installed PHP version and the server environment. Affected are PHP installations that serve web requests — the PHP advisory names, among others, PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. On 21 October 2026 the security releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were published. We check which version is running on your system and what needs to be done.
Do I have to take my website offline because of the PHP vulnerability?
Not necessarily. What matters is whether the security update can be applied promptly. If that is not possible, the risk must be assessed case by case — for particularly exposed systems, a temporary restriction or shutdown may be advisable. The PHP project lists interim settings, but explicitly points out that they do not make an installation secure.
Can my website be hacked through this vulnerability?
Both vulnerabilities are classified as unauthenticated remote code execution, with a CVSS v4.0 severity score of 9.2 — so an attacker does not need any credentials. Whether a specific system is vulnerable or already compromised can only be determined by examining the server and its logs; there is no blanket answer.
What happens if I do not install the PHP update?
A vulnerable system remains vulnerable. The PHP project recommends updating immediately and names no measure that fully replaces the update. Depending on configuration and operating mode, a server is more or less easy to attack — but without the update, the risk remains.
Will my website still work after a PHP update?
For a security update within the same branch — for example from 8.3.20 to 8.3.36 — code changes are rarely necessary. A jump across branches, for example from 7.4 to 8.4, is a different matter: functions have been removed there and behaviour has changed. That is why the application is checked beforehand rather than repaired afterwards.
Can you also update my old PHP code?
Yes. We replace removed functions, correct incompatible parts of the code, update dependencies and establish compatibility with the target version — for custom-built applications just as for legacy systems that have grown over the years.
Can you apply the update directly on my server?
Yes. We take care of the server side — PHP version, PHP-FPM, extensions, web server integration — and the application code. That is the difference from a pure hosting provider and from a pure agency: you do not need two service providers for the two halves of the problem.
How much does a PHP update cost?
That depends on the scope. A security update within one branch is a manageable task; migrating a custom application that has grown over many years is a project. We look at the starting situation and tell you the effort involved before anything is touched.
How long does a PHP migration take?
A security update is a matter of hours if the code plays along. A version jump with code adjustments takes longer — how long can be stated reliably once the version, environment and code base have been checked. Before that, any figure would be a guess.
Can a PHP update be carried out without downtime?
Depending on the infrastructure, the changeover can be prepared so that the interruption is very short. A completely interruption-free changeover is not possible on every system — we tell you beforehand what is feasible in your case instead of promising it.
I use PHP 7.4. Can you update my website?
Yes. PHP 7.4 has not received regular updates from the PHP project since 28 November 2022; for the current vulnerabilities there is only a backport branch. The sustainable path is moving to a supported branch — we check the application and carry out the necessary adjustments.
Do I have to have my website completely redeveloped?
As a rule, no. In most cases the existing application can continue to run with targeted adjustments. For severely outdated systems we calculate both options and tell you frankly at what point modernisation becomes cheaper than repair.
Which PHP versions are currently supported?
The 8.2, 8.3, 8.4 and 8.5 branches are supported. 8.4 and 8.5 are in active development; 8.2 and 8.3 only receive security updates. PHP 8.2 reaches its end of support on 31 December 2026, PHP 8.3 on 31 December 2027.
What does PHP end of life mean?
After the end of support, the PHP project no longer publishes regular security updates for that branch — newly discovered vulnerabilities remain open there. This must be distinguished from security backports by individual Linux distributions or commercial providers: these can close individual vulnerabilities, but they do not replace a supported branch.
Contact

Have your PHP installation checked now

You are not sure whether your website is affected? Or your server needs a PHP update that your software may not support? Briefly describe your technical situation to us — we will tell you what needs to be done and, if you wish, take care of it right away: security update, version change and the modernisation of your existing application.

Request PHP update now →
Phone number +49 5522 3175515 available daily 10 am – 9 pm
Email address kontakt@cxp.rocks