PHP2Shell, server security and emergency helphttps://phpsos.de/en/2026-10-25T08:00:00+01:00PHP SOShttps://phpsos.de/en/blog/php2shell-was-belegt-ist/2026-10-25T08:00:00+01:00

PHP2Shell facts checked: which claims php.net, the BSI and vendors confirm, what is only reported, and which rumours you can safely ignore.

https://phpsos.de/en/blog/php-luecke-vorzeitig-bekannt/2026-10-25T08:00:00+01:00

Why the PHP vulnerability became known before the patch: how embargoes work, what happened on 20 October and what operators can learn for patching.

https://phpsos.de/en/blog/behoerden-webseiten-offline/2026-10-25T08:00:00+01:00

Authorities took websites offline as a precaution over PHP2Shell. What lies behind it, when a shutdown makes sense and how companies can prepare for one.

https://phpsos.de/en/blog/bsi-warnstufe-orange-erklaert/2026-10-25T08:00:00+01:00

BSI warning level orange explained: what the four levels mean, why PHP2Shell counts as business-critical and which decisions companies need to make now.

https://phpsos.de/en/blog/cert-eu-empfehlungen-php/2026-10-25T08:00:00+01:00

What CERT-EU, CERT-Bund and the BSI advise on PHP2Shell, where their recommendations overlap and how to isolate publicly reachable PHP applications.

https://phpsos.de/en/blog/cloudflare-waf-php2shell/2026-10-25T08:00:00+01:00

Cloudflare has protected against PHP2Shell with WAF rules since 21 October. What the rules cover, where they can be bypassed and what to check now.

https://phpsos.de/en/blog/exponierte-instanzen-einordnen/2026-10-25T08:00:00+01:00

22.6 million instances, 2.24 million hosts: how many servers PHP2Shell affects, why the figures differ and what they mean for your company.

https://phpsos.de/en/blog/php2shell-briefing-geschaeftsfuehrung/2026-10-25T08:00:00+01:00

PHP2Shell in five minutes: the situation, the business risk, five questions for your IT team and the decisions managing directors should make today.

https://phpsos.de/en/blog/php-luecke-einfach-erklaert/2026-10-25T08:00:00+01:00

The PHP vulnerability explained simply: what PHP is, what goes wrong with PHP2Shell, what the technical terms mean and what website operators should do now.

https://phpsos.de/en/blog/fragen-von-hosting-kunden/2026-10-25T08:00:00+01:00

PHP vulnerability and hosting: 15 questions from hosting customers about PHP2Shell, with short answers on responsibility, version display, proof and suspected cases.

https://phpsos.de/en/blog/warum-wordpress-update-nicht-hilft/2026-10-25T08:00:00+01:00

Why a WordPress update does not help against the PHP vulnerability PHP2Shell, which layer really counts and what WordPress operators should check instead.

https://phpsos.de/en/blog/php2shell-und-log4shell/2026-10-25T08:00:00+01:00

PHP2Shell and Log4Shell compared: what links the vulnerabilities, where they differ and which lessons from 2021 companies can use today.

https://phpsos.de/en/blog/automatisierte-massenscans/2026-10-25T08:00:00+01:00

Automated attacks on web servers: how mass scans for unpatched PHP work, why small companies are targets too and what you can do to protect yourself.

https://phpsos.de/en/blog/zeitfenster-patch-angriff/2026-10-25T08:00:00+01:00

The time window between patch and attack explained: the phases with PHP2Shell, how to measure your own window and which steps shorten it.

https://phpsos.de/en/blog/weitere-php-meldungen/2026-10-25T08:00:00+01:00

After PHP2Shell, further PHP announcements are likely. How to tell, which sources to watch and how your team can respond in a prepared way.

https://phpsos.de/en/blog/lagebild-erste-woche/2026-10-25T08:00:00+01:00

PHP2Shell latest: what is confirmed after one week, how the BSI and CERTs assess the situation, what is known about attacks and what operators should check.

https://phpsos.de/en/blog/gefaehrliche-falschtipps/2026-10-25T08:00:00+01:00

PHP2Shell tips fact-checked: which circulating advice does not protect or even does harm, and what php.net, the BSI and specialist authors advise instead.

https://phpsos.de/en/blog/php-version-hosting-aendern/2026-10-25T08:00:00+01:00

Change the PHP version in hosting without putting the website at risk: preparation, the right target version, testing after the switch and the way back.

https://phpsos.de/en/blog/debian-ubuntu-paket-gepatcht/2026-10-25T08:00:00+01:00

Is your PHP package on Debian or Ubuntu patched against PHP2Shell? Corrected package versions per release, check commands and typical pitfalls for admins.

https://phpsos.de/en/blog/rhel-almalinux-rocky-php/2026-10-25T08:00:00+01:00

Check the PHP patch on RHEL, AlmaLinux and Rocky: what Red Hat reports on PHP2Shell, how to query errata, changelog and modules, and how to restart correctly.

https://phpsos.de/en/blog/sury-repository-php/2026-10-25T08:00:00+01:00

The sury PHP repository for Debian and Ubuntu: who maintains it, how it differs from Debian, how to check the PHP2Shell status and when it becomes a risk.

https://phpsos.de/en/blog/remi-repository-php/2026-10-25T08:00:00+01:00

The Remi PHP repository on RHEL, AlmaLinux and Rocky: understand module streams and SCL packages, check the PHP2Shell status and restart every version.

https://phpsos.de/en/blog/php-v-zeigt-alte-nummer/2026-10-25T08:00:00+01:00

php -v shows the same version number after the update? Why backports cause this, when it is harmless, when it is a warning sign and how to clarify it.

https://phpsos.de/en/blog/cve-im-changelog-nachweisen/2026-10-25T08:00:00+01:00

Check a CVE in the changelog and prove the PHP patch: where changelogs are stored, how to search them, what a missing entry means and what solid proof looks like.

https://phpsos.de/en/blog/hoster-wechseln-nach-vorfall/2026-10-25T08:00:00+01:00

Switching hosting providers after a security incident: the right order, securing evidence, moving only clean data and vetting the new provider on security.

https://phpsos.de/en/blog/mehrere-php-versionen-server/2026-10-25T08:00:00+01:00

Multiple PHP versions on one server: find every installation, clarify origin and responsibility, patch each one separately, restart it and document the proof.

https://phpsos.de/en/blog/alte-php-versionen-abschalten/2026-10-25T08:00:00+01:00

Disable old PHP versions without breaking websites: identify usage, block first, then uninstall. With tested steps for Plesk.

https://phpsos.de/en/blog/plesk-php-handler/2026-10-25T08:00:00+01:00

Plesk PHP handlers compared: FPM, Dedicated FPM, FastCGI and the Apache module from a security view, with notes on PHP2Shell, nginx and .htaccess.

https://phpsos.de/en/blog/cloudlinux-alt-php/2026-10-25T08:00:00+01:00

CloudLinux alt-php and PHP2Shell: which PHP version your account uses, who patches the alt-php packages and which questions to put to your hoster now.

https://phpsos.de/en/blog/php-auf-nas-und-appliances/2026-10-25T08:00:00+01:00

PHP vulnerability on NAS, firewalls and appliances: which devices can use PHP, how to find them and what to do until the firmware update is available.

https://phpsos.de/en/blog/paas-php-laufzeit/2026-10-25T08:00:00+01:00

PHP update on PaaS and cloud platforms: who patches the PHP runtime, why a new build is often needed and how to prove the version that is actually serving.

https://phpsos.de/en/blog/offizielle-php-docker-images/2026-10-25T08:00:00+01:00

PHP Docker image tags explained: version tags, variants such as fpm and apache, digests, and how to check before use whether an image closes PHP2Shell.

https://phpsos.de/en/blog/php-images-in-ci-neu-bauen/2026-10-25T08:00:00+01:00

Rebuild Docker images automatically: scheduled builds, a version check in the pipeline and rollout by digest, so that PHP patches reliably reach production.

https://phpsos.de/en/blog/langzeitsupport-alte-php-versionen/2026-10-25T08:00:00+01:00

PHP extended support for 8.1 and older: which routes exist, what providers must confirm in writing and why long-term support is only a bridge.

https://phpsos.de/en/blog/php-unter-windows-aktualisieren/2026-10-25T08:00:00+01:00

Update PHP on Windows: pick the right variant, verify the download by SHA-256, carry over php.ini and watch out for Apache module mode with PHP2Shell.

https://phpsos.de/en/blog/webserver-startet-shell/2026-10-25T08:00:00+01:00

PHP-FPM or Apache starting a shell? How to read the process tree, separate harmless cases from break-in traces and monitor the pattern permanently.

https://phpsos.de/en/blog/verdaechtige-prozesse-linux/2026-10-25T08:00:00+01:00

Find suspicious processes on Linux: spot deleted program files, disguised names and start locations, match processes to packages and secure traces.

https://phpsos.de/en/blog/cronjobs-als-hintertuer/2026-10-25T08:00:00+01:00

Detect a cron job backdoor: check every place for scheduled tasks on Linux, interpret suspicious entries and secure what you find before you delete it.

https://phpsos.de/en/blog/geaenderte-dateien-finden/2026-10-25T08:00:00+01:00

Find changed files on Linux: interpret time windows with find, mtime and ctime correctly, compare against packages and backups and filter out false alarms.

https://phpsos.de/en/blog/php-dateien-im-upload-ordner/2026-10-25T08:00:00+01:00

PHP file found in the uploads folder? How to interpret the find, check access in the log, tell harmless placeholders from webshells and act correctly.

https://phpsos.de/en/blog/verschleierter-php-code/2026-10-25T08:00:00+01:00

eval, base64_decode and more: how to recognize obfuscated PHP code, search for it safely and tell legitimate encoders apart from malicious code.

https://phpsos.de/en/blog/ausgehende-verbindungen-pruefen/2026-10-25T08:00:00+01:00

Check a server's outgoing connections: match processes with ss and lsof, assess unknown destinations and limit data leaks with egress filtering.

https://phpsos.de/en/blog/fremde-admin-konten-finden/2026-10-25T08:00:00+01:00

Find rogue admin accounts: how to check CMS, hosting panel, Linux server and database for unknown access and handle what you find correctly.

https://phpsos.de/en/blog/ssh-schluessel-pruefen/2026-10-25T08:00:00+01:00

Check authorized_keys: where SSH keys live on the server, how to spot foreign entries, remove them safely and harden SSH access afterward.

https://phpsos.de/en/blog/kryptominer-auf-dem-server/2026-10-25T08:00:00+01:00

Recognize a crypto miner on the server: check constant load, foreign processes, connections and restart mechanisms, secure traces and close the cause.

https://phpsos.de/en/blog/server-verschickt-spam/2026-10-25T08:00:00+01:00

Your server is sending spam? How to find the source in the mail queue, PHP scripts and mailboxes, stop the sending and get off blocklists.

https://phpsos.de/en/blog/seo-spam-im-google-index/2026-10-25T08:00:00+01:00

SEO spam after a hack: how to spot foreign pages in the Google index, find out where they are generated and clean up the index for good.

https://phpsos.de/en/blog/website-leitet-um/2026-10-25T08:00:00+01:00

Your website redirects to foreign sites? Check DNS, CDN, web server, PHP code, database and external scripts layer by layer to find the cause.

https://phpsos.de/en/blog/beweise-sichern-vor-neuinstallation/2026-10-25T08:00:00+01:00

Preserving evidence before a reinstall: which traces on the server are volatile, in what order to secure them and how to keep the copy reliable.

https://phpsos.de/en/blog/zeitleiste-eines-vorfalls/2026-10-25T08:00:00+01:00

Build an IT incident timeline: use sources and time zones correctly and mark every statement as documented, probable or unknown.

https://phpsos.de/en/blog/cms-kerndateien-vergleichen/2026-10-25T08:00:00+01:00

Compare CMS core files with the original: checksums, a clean reference state and diff explained for WordPress, Composer projects and system packages.

https://phpsos.de/en/blog/datenbank-auf-schadcode-pruefen/2026-10-25T08:00:00+01:00

Check your database for malicious code: find injected scripts, foreign addresses, triggers and accounts with read-only queries, without destroying data.

https://phpsos.de/en/blog/grenzen-von-malware-scannern/2026-10-25T08:00:00+01:00

Website malware scanners: what external, plugin and server scanners detect, where their limits lie and why “nothing found” does not mean clean.

https://phpsos.de/en/blog/php-fpm-pools-isolieren/2026-10-25T08:00:00+01:00

Isolate PHP-FPM pools per website: check existing pools, protect sockets, limit extensions, hide status pages and set limits for each pool.

https://phpsos.de/en/blog/memory-limit-richtig-setzen/2026-10-25T08:00:00+01:00

Set PHP memory_limit correctly: what the value does, where it applies, what php.net advises for PHP2Shell for now and what should apply after the update.

https://phpsos.de/en/blog/post-max-size-upload-limits/2026-10-25T08:00:00+01:00

Limit post_max_size and upload_max_filesize: how they interact with web server limits, php.net's interim values for PHP2Shell and typical error symptoms.

https://phpsos.de/en/blog/session-upload-progress-abschalten/2026-10-25T08:00:00+01:00

Set session.upload_progress.enabled=0 correctly: where the value takes effect, how to lock it against being re-enabled and how to verify it safely in the web context.

https://phpsos.de/en/blog/expose-php-versionsangaben/2026-10-25T08:00:00+01:00

expose_php, X-Powered-By and Server header: where PHP and web servers reveal their version, and how to switch it off and verify it in php.ini, Nginx and Apache.

https://phpsos.de/en/blog/display-errors-produktion/2026-10-25T08:00:00+01:00

display_errors Off and more: which PHP settings keep error messages off the live website, what frameworks add and how to check for leaks.

https://phpsos.de/en/blog/php-admin-value-sperren/2026-10-25T08:00:00+01:00

php_admin_value and php_admin_flag explained: how to lock PHP values in the FPM pool and Apache against ini_set(), .htaccess and .user.ini, and verify it.

https://phpsos.de/en/blog/speichergrenzen-systemd-cgroups/2026-10-25T08:00:00+01:00

systemd MemoryMax for PHP-FPM: set a cgroup memory limit as php.net recommends for PHP2Shell, with MemoryHigh, OOMPolicy and check commands.

https://phpsos.de/en/blog/nginx-fuer-php-absichern/2026-10-25T08:00:00+01:00

Configure Nginx for PHP securely: pass only real scripts to PHP-FPM, allow the front controller, block dotfiles and set size limits appropriately.

https://phpsos.de/en/blog/apache-fuer-php-absichern/2026-10-25T08:00:00+01:00

Configure Apache for PHP securely: set up PHP-FPM via mod_proxy_fcgi, AllowOverride None, ServerTokens, TraceEnable and LimitRequestBody correctly and verify.

https://phpsos.de/en/blog/php-in-uploads-verbieten/2026-10-25T08:00:00+01:00

Forbid PHP execution in uploads: find writable folders, set blocks in Nginx, Apache and PHP-FPM correctly and test with a harmless file.

https://phpsos.de/en/blog/upload-anfragen-am-rand-filtern/2026-10-25T08:00:00+01:00

Filter multipart/form-data at the proxy or WAF: when the unofficial interim measure helps, what it breaks and how to introduce it safely.

https://phpsos.de/en/blog/modsecurity-owasp-crs/2026-10-25T08:00:00+01:00

Use ModSecurity and OWASP CRS: choose the right engine, understand anomaly thresholds and paranoia levels, and handle false positives in a targeted way.

https://phpsos.de/en/blog/fail2ban-fuer-webserver/2026-10-25T08:00:00+01:00

Fail2ban for Nginx and Apache: enable suitable jails, test custom filters with fail2ban-regex, ban repeat offenders and avoid locking yourself out.

https://phpsos.de/en/blog/firewall-fuer-webserver/2026-10-25T08:00:00+01:00

Firewall for web servers: check open ports, allow only 80 and 443, restrict SSH, limit outgoing connections. With nftables and ufw.

https://phpsos.de/en/blog/automatische-sicherheitsupdates/2026-10-25T08:00:00+01:00

Set up unattended-upgrades and dnf-automatic: apply security updates automatically, restart services and release third-party sources selectively.

https://phpsos.de/en/blog/rechte-des-webserver-benutzers/2026-10-25T08:00:00+01:00

Give the web server user minimal rights: no shell, no sudo, no cron, narrow database privileges and systemd protection for PHP-FPM, with check commands.

https://phpsos.de/en/blog/admin-bereiche-abschirmen/2026-10-25T08:00:00+01:00

Protect the admin area with an IP allowlist, VPN or upstream login: which method fits, pitfalls behind CDN and proxy, with configuration and testing.

https://phpsos.de/en/blog/tls-https-richtig-konfigurieren/2026-10-25T08:00:00+01:00

TLS configuration for web servers per BSI TR-02102 and TLSRef: protocols, cipher suites, certificates and check commands for Nginx, Apache and PHP clients.

https://phpsos.de/en/blog/cis-benchmarks-bsi-bausteine/2026-10-25T08:00:00+01:00

CIS Benchmark for web servers and BSI modules compared: which standards fit Linux, Nginx, Apache and PHP, and how to put them into practice.

https://phpsos.de/en/blog/passwoerter-in-php-speichern/2026-10-25T08:00:00+01:00

Store passwords securely in PHP with password_hash: bcrypt or Argon2id, cost factor, the 72-byte limit and migrating from old MD5 hashes.

https://phpsos.de/en/blog/csrf-schutz-php/2026-10-25T08:00:00+01:00

Implement CSRF protection in PHP: synchronizer token, checking Origin and Sec-Fetch-Site, SameSite cookies and login CSRF. With code example and checklist.

https://phpsos.de/en/blog/eingaben-validieren-php/2026-10-25T08:00:00+01:00

Validate input in PHP with filter_var and filter_input_array: numbers, email, URL, bool, allowlists and limits. With code examples.

https://phpsos.de/en/blog/command-injection-php/2026-10-25T08:00:00+01:00

Prevent command injection in PHP: avoid the shell, use proc_open with an array, apply escapeshellarg correctly and find dangerous calls in your code.

https://phpsos.de/en/blog/ssrf-in-php/2026-10-25T08:00:00+01:00

Prevent SSRF in PHP: allowlists, HTTPS only, no redirects, checking the resolved IP and limiting outgoing traffic. With cURL code.

https://phpsos.de/en/blog/xxe-in-php/2026-10-25T08:00:00+01:00

Prevent XXE in PHP: what applies since libxml 2.9 and PHP 8.0, which flags are risky, LIBXML_NO_XXE from PHP 8.4 and how to find XML inputs.

https://phpsos.de/en/blog/type-juggling-php/2026-10-25T08:00:00+01:00

Understand PHP type juggling: how == compares, what PHP 8.0 changed and why tokens, hashes and roles must be compared strictly.

https://phpsos.de/en/blog/sichere-tokens-php/2026-10-25T08:00:00+01:00

Generate secure tokens in PHP with random_bytes and random_int: length, encoding, storing as a hash, expiry time and functions to avoid.

https://phpsos.de/en/blog/env-dateien-schuetzen/2026-10-25T08:00:00+01:00

Protect .env files: correct web root, blocking in the web server, tight file permissions, no secrets in Git and credential rotation after a security incident.

https://phpsos.de/en/blog/git-ordner-oeffentlich/2026-10-25T08:00:00+01:00

Is your .git folder public? Here is how to check, block access, change your deployment and handle credentials from the history.

https://phpsos.de/en/blog/backup-dateien-im-webroot/2026-10-25T08:00:00+01:00

Anyone can download backup files in the web root. Find .zip, .sql and .bak files, block them and check whether they have been retrieved.

https://phpsos.de/en/blog/phpinfo-dateien-entfernen/2026-10-25T08:00:00+01:00

A forgotten phpinfo file reveals paths, modules and sometimes credentials. Find and remove such files and check PHP in safer ways.

https://phpsos.de/en/blog/abhaengigkeiten-aktuell-halten/2026-10-25T08:00:00+01:00

Keep Composer packages, npm modules and CMS plugins up to date: a maintenance process with rhythm, responsibility, tests and a plan for cases without a patch.

https://phpsos.de/en/blog/sicherheits-code-review-php/2026-10-25T08:00:00+01:00

Security code review for PHP: baseline or diff, risky functions, tools such as PHPStan and Psalm, and a checklist for your own team.

https://phpsos.de/en/blog/sicher-loggen-php/2026-10-25T08:00:00+01:00

Log errors and events in PHP without exposing passwords, tokens or customer data: what belongs in the log, what does not and how to protect it.

https://phpsos.de/en/blog/rest-api-php-absichern/2026-10-25T08:00:00+01:00

Secure REST APIs in PHP: authentication, per-object checks, JWT, size and type limits, error messages and rate limiting with example code.

https://phpsos.de/en/blog/dienstleistervertrag-sicherheit/2026-10-25T08:00:00+01:00

What a contract with an agency, host or IT service provider should regulate on security: updates, restarts, reporting channels, logs, access and exit.

https://phpsos.de/en/blog/auftragsverarbeitung-serverzugriff/2026-10-25T08:00:00+01:00

Remote maintenance, patching, forensics: what a DPA under Art. 28 GDPR regulates when IT service providers access servers, and what to clarify before an emergency.

https://phpsos.de/en/blog/schwachstellenmanagement-mittelstand/2026-10-25T08:00:00+01:00

Vulnerability management for SMEs: sources for alerts, risk-based assessment, decision, implementation and evidence, using PHP2Shell as a worked example.

https://phpsos.de/en/blog/inventar-websites-server/2026-10-25T08:00:00+01:00

An IT inventory of all websites and servers: which details to include, how to find forgotten systems and how to keep the list up to date.

https://phpsos.de/en/blog/patch-management-prozess/2026-10-25T08:00:00+01:00

Patch management as a process: patch classes, maintenance windows, testing, rollback, restart and evidence, so critical updates like PHP2Shell stick.

https://phpsos.de/en/blog/notfallkontakte-liste/2026-10-25T08:00:00+01:00

Emergency contacts for IT incidents: who belongs on the list, who is informed when, what details must be ready and how to keep the list up to date.

https://phpsos.de/en/blog/kostenposten-eines-hacks/2026-10-25T08:00:00+01:00

What a hacked server costs a company: direct, indirect and follow-on costs at a glance, with advice on how to draw up your own calculation.

https://phpsos.de/en/blog/kunden-nach-vorfall-informieren/2026-10-25T08:00:00+01:00

Informing customers after a data breach: when Art. 34 GDPR applies, how to reach customer groups and why notices should never contain login links.

https://phpsos.de/en/blog/lieferkette-agentur-hoster/2026-10-25T08:00:00+01:00

Your website depends on the PHP project, distribution, host, agency and plugin vendors. How to make this supply chain visible and dependable.

https://phpsos.de/en/blog/sicherheitsbewusstsein-redaktion/2026-10-25T08:00:00+01:00

Security awareness for admins and editors: which risks matter per role, how short training sessions work and how to get a web team up to speed in 90 days.

https://phpsos.de/en/blog/notfalluebung-am-tisch/2026-10-25T08:00:00+01:00

Tabletop exercise for IT: how to play through a web server incident at the table, with script, roles, injects and an evaluation that changes something.

https://phpsos.de/en/blog/iso-27001-tisax-webserver/2026-10-25T08:00:00+01:00

ISO 27001 and TISAX on the web server: which requirements affect patches, suppliers and incidents, and which evidence belongs in the file after PHP2Shell.

https://phpsos.de/en/blog/vds-10000-kmu/2026-10-25T08:00:00+01:00

VdS 10000 explained: what the SME guideline requires, what is new in the 2025 version and which requirements affect your website and web server.

https://phpsos.de/en/blog/lessons-learned-nach-vorfall/2026-10-25T08:00:00+01:00

Lessons learned after an IT incident: when to hold the review, which questions matter and how findings become actions with a deadline.

https://phpsos.de/en/blog/patchen-abschalten-abwarten/2026-10-25T08:00:00+01:00

Take your website offline because of the PHP vulnerability? A decision aid for choosing between patching, shutting down and waiting, with criteria, steps and limits.

https://phpsos.de/en/blog/waf-oder-update/2026-10-25T08:00:00+01:00

WAF instead of an update for PHP2Shell? What a web application firewall does, where it ends and why only the PHP update with restart closes the vulnerability.

https://phpsos.de/en/blog/neu-aufsetzen-oder-bereinigen/2026-10-25T08:00:00+01:00

Rebuild a server after a hack or clean it up? The criteria, the right order and typical mistakes when rebuilding, explained clearly.

https://phpsos.de/en/blog/selbst-beheben-oder-dienstleister/2026-10-25T08:00:00+01:00

Hire an IT security provider or fix it yourself? An honest weighing with criteria, a self-test and cases in which you need no outside help.

https://phpsos.de/en/blog/sicherheitsdienstleister-auswaehlen/2026-10-25T08:00:00+01:00

Finding an IT security provider: 12 questions for comparing vendors for web servers and PHP on the facts, plus typical warning signs in quotes.

https://phpsos.de/en/blog/managed-oder-eigener-server/2026-10-25T08:00:00+01:00

Managed hosting or root server? The security comparison: who patches, who is responsible and which model suits your team and your data.

https://phpsos.de/en/blog/php-upgrade-oder-backport/2026-10-25T08:00:00+01:00

PHP upgrade or backport after PHP2Shell? Which kinds of backport exist, what they are worth and when only moving to a supported version helps.

https://phpsos.de/en/blog/cms-wechsel-nach-hack/2026-10-25T08:00:00+01:00

Switch CMS after a hack? When a new system really helps, when it only shifts the effort and how to move content without carrying over malicious code.

https://phpsos.de/en/blog/statische-website-alternative/2026-10-25T08:00:00+01:00

Static website and security: what falls away without PHP on the server, which risks remain and for which companies switching is really worthwhile.

https://phpsos.de/en/blog/pentest-bugbounty-scan/2026-10-25T08:00:00+01:00

Pentest or vulnerability scan, or straight to bug bounty? What each testing method finds, where it is blind and in which order it makes sense for SMEs.

https://phpsos.de/en/php2shell/was-ist-php2shell/2026-10-25T08:00:00+01:00

PHP2Shell explained simply: what is behind the two critical PHP vulnerabilities, which servers are affected and which steps you should take now.

https://phpsos.de/en/php2shell/cve-2026-109618/2026-10-25T08:00:00+01:00

CVE-2026-109618 explained: how the out-of-memory condition in PHP can lead to code execution, which versions are fixed and what admins should do now.

https://phpsos.de/en/php2shell/cve-2026-109619/2026-10-25T08:00:00+01:00

CVE-2026-109619 explained: why internal state carried between requests becomes dangerous, which PHP versions are fixed and how to secure your servers.

https://phpsos.de/en/php2shell/cve-2026-115560/2026-10-25T08:00:00+01:00

CVE-2026-115560: when the third PHP advisory of 23 October 2026 affects your server, how to check your configuration and how to disable upload progress.

https://phpsos.de/en/php2shell/betroffene-php-versionen/2026-10-25T08:00:00+01:00

Which PHP versions PHP2Shell affects and which are fixed: version table for 8.5 to 5.4, notes on backports, end of support and how to proceed.

https://phpsos.de/en/php2shell/php-version-pruefen/2026-10-25T08:00:00+01:00

Check your PHP version properly: how to recognise patch level, distribution backports and running processes, and know whether PHP2Shell is closed.

https://phpsos.de/en/php2shell/mod-php-risiko/2026-10-25T08:00:00+01:00

Why the PHP team rates the PHP2Shell risk highest for Apache with mod_php, how to recognise mod_php and what you should patch and switch over now.

https://phpsos.de/en/php2shell/php-fpm-neustart/2026-10-25T08:00:00+01:00

Restart PHP-FPM after the PHP2Shell update: why new files are not enough, which services matter and how to check that no old worker is still running.

https://phpsos.de/en/php2shell/sofortmassnahmen-ohne-patch/2026-10-25T08:00:00+01:00

Workaround for the PHP vulnerability PHP2Shell: the interim measures from php.net, set correctly, with their limits and notes on the road to the patch.

https://phpsos.de/en/php2shell/php-8-1-und-aelter/2026-10-25T08:00:00+01:00

PHP 8.1 and older get no official update against PHP2Shell. What source backports mean, how to secure your server and how to plan the move.

https://phpsos.de/en/php2shell/docker-container-patchen/2026-10-25T08:00:00+01:00

Update your PHP Docker image against PHP2Shell: check the version in the container, rebuild the image, recreate containers and set interim values.

https://phpsos.de/en/php2shell/bin-ich-gehackt-anzeichen/2026-10-25T08:00:00+01:00

Server hacked? Typical signs after PHP2Shell, first checks that preserve evidence and what to do if you suspect a compromise, step by step.

https://phpsos.de/en/ratgeber/php2shell-chronologie/2026-10-25T08:00:00+01:00

The PHP2Shell timeline at a glance: from the first attack attempt on 17 Oct to the status of 25 Oct 2026, and what each date means for your logs and checks.

https://phpsos.de/en/ratgeber/hoster-patch-status-erfragen/2026-10-25T08:00:00+01:00

How to get reliable confirmation of the PHP update from your hosting provider after PHP2Shell: which details count, a copy-ready template, how to judge the answer.

https://phpsos.de/en/ratgeber/webshell-erkennen/2026-10-25T08:00:00+01:00

Detect webshells after PHP2Shell: find suspicious PHP files, processes and connections, preserve evidence and have backdoors removed properly.

https://phpsos.de/en/ratgeber/backdoor-wordpress-finden/2026-10-25T08:00:00+01:00

Find a WordPress backdoor: check core and plugins with WP-CLI, review admin accounts, mu-plugins, uploads and the database, and close backdoors safely.

https://phpsos.de/en/ratgeber/php-ini-sicher-konfigurieren/2026-10-25T08:00:00+01:00

Configure php.ini securely: settings for errors, sessions, uploads and memory, plus the PHP2Shell interim measures from php.net, ready to copy.

https://phpsos.de/en/ratgeber/disable-functions/2026-10-25T08:00:00+01:00

Use PHP disable_functions correctly: which functions to block, how to test your application beforehand and where this hardening reaches its limits.

https://phpsos.de/en/ratgeber/open-basedir/2026-10-25T08:00:00+01:00

Set open_basedir correctly and separate websites cleanly: own user, own PHP-FPM pool, own temp folders. With an example configuration for Nginx.

https://phpsos.de/en/ratgeber/dateirechte-webserver/2026-10-25T08:00:00+01:00

Set web server file permissions correctly: separate owners, 640 instead of 777, write access only for uploads and cache. With commands to check them.

https://phpsos.de/en/ratgeber/composer-abhaengigkeiten-pruefen/2026-10-25T08:00:00+01:00

Use composer audit to check PHP dependencies for vulnerabilities. Commands, integration into CI and deployment, and why PHP itself must be patched separately.

https://phpsos.de/en/ratgeber/php-end-of-life-risiken/2026-10-25T08:00:00+01:00

Understand PHP end of life: what happens after support ends, why PHP 8.1 and older are critical after PHP2Shell, and how to plan the move to 8.2 or later.

https://phpsos.de/en/ratgeber/sql-injection-php/2026-10-25T08:00:00+01:00

Prevent SQL injection in PHP: prepared statements with PDO and mysqli, whitelists for columns, minimal database rights. With code examples and a checklist.

https://phpsos.de/en/ratgeber/xss-php/2026-10-25T08:00:00+01:00

Prevent XSS in PHP: encode output correctly for each context, use templates with auto-escaping and set a Content Security Policy. With examples.

https://phpsos.de/en/ratgeber/datei-upload-sicher/2026-10-25T08:00:00+01:00

PHP upload security in practice: check the file type on the server, rename files, store them outside the web root and block script execution.

https://phpsos.de/en/ratgeber/session-sicherheit-php/2026-10-25T08:00:00+01:00

PHP session security step by step: secure php.ini values, a new session ID after login, cookie flags and the PHP2Shell note on upload progress.

https://phpsos.de/en/ratgeber/deserialisierung-php/2026-10-25T08:00:00+01:00

Use PHP unserialize safely: why objects from user input are dangerous, how JSON, allowed_classes and signatures protect, and where to look in your code.

https://phpsos.de/en/ratgeber/lfi-rfi/2026-10-25T08:00:00+01:00

Prevent local file inclusion in PHP: allow-lists instead of paths from the request, a realpath check, allow_url_include off and open_basedir as protection.

https://phpsos.de/en/ratgeber/brute-force-login-schutz/2026-10-25T08:00:00+01:00

Brute-force protection for login and admin area: implement rate limiting, Fail2ban, two-factor login and secure password storage with password_hash.

https://phpsos.de/en/ratgeber/ddos-oder-exploit/2026-10-25T08:00:00+01:00

DDoS or hack? Typical signs compared, first check commands for the server and what you should concretely do in the first hours.

https://phpsos.de/en/ratgeber/logfiles-auswerten/2026-10-25T08:00:00+01:00

Analyse access logs after an attack: secure the logs first, find typical traces, use commands for Apache and Nginx, and note the specifics of PHP2Shell.

https://phpsos.de/en/ratgeber/zwei-faktor-admin/2026-10-25T08:00:00+01:00

Two-factor authentication for admins: suitable methods, all important access points from the CMS to SSH, emergency codes and a clean rollout in the team.

https://phpsos.de/en/ratgeber/backups-3-2-1/2026-10-25T08:00:00+01:00

Server backup strategy using the 3-2-1 rule: what you must back up, how backups survive an attack and why you should test restoration.

https://phpsos.de/en/ratgeber/sicherheits-header/2026-10-25T08:00:00+01:00

Set up security headers for websites: CSP, HSTS, X-Content-Type-Options and more, with examples for Nginx and Apache, plus testing and typical mistakes.

https://phpsos.de/en/ratgeber/google-warnung-entfernen/2026-10-25T08:00:00+01:00

Remove the Google warning for a hacked website: find the cause, clean up spam and malicious code, check Search Console and request the review.

https://phpsos.de/en/ratgeber/checkliste-nach-dem-hack/2026-10-25T08:00:00+01:00

Checklist for a hacked website: 20 steps from containment and evidence preservation through cleanup and new credentials to reporting duties.

https://phpsos.de/en/php/was-ist-php/2026-10-25T08:00:00+01:00

What is PHP? How the scripting language builds web pages on the server, where it runs in your company and why its version matters for security.

https://phpsos.de/en/php/geschichte-von-php/2026-10-25T08:00:00+01:00

The history of PHP: from Rasmus Lerdorf's Personal Home Page Tools in 1994 through the Zend Engine and PHP 7 to PHP 8.5, with a timeline and lessons for today.

https://phpsos.de/en/php/wie-php-funktioniert/2026-10-25T08:00:00+01:00

How does PHP work? From the click in the browser via web server, SAPI, compiler and Zend VM to the finished page, explained in seven steps with examples.

https://phpsos.de/en/php/zend-engine/2026-10-25T08:00:00+01:00

The Zend Engine explained: compiler, opcodes, virtual machine, zval and memory management at the core of PHP, its versions and what it means for patches.

https://phpsos.de/en/php/opcache/2026-10-25T08:00:00+01:00

OPcache explained: how PHP's bytecode cache works, which settings matter, why it must be cleared after updates and how to secure it on shared servers.

https://phpsos.de/en/php/sapi-erklaert/2026-10-25T08:00:00+01:00

PHP SAPI explained: what fpm-fcgi, apache2handler, cgi-fcgi and cli mean, how to check your operating mode and why it determines risk and restarts.

https://phpsos.de/en/php/php-fpm-erklaert/2026-10-25T08:00:00+01:00

PHP-FPM explained: how master, pools and workers operate, what pm static, dynamic and ondemand mean and which pool settings improve security.

https://phpsos.de/en/php/mod-php-erklaert/2026-10-25T08:00:00+01:00

mod_php explained: how PHP runs as an Apache module, how to recognise it, what prefork and .htaccess mean for it and why php.net advises against it.

https://phpsos.de/en/php/cgi-und-fastcgi/2026-10-25T08:00:00+01:00

CGI and FastCGI with PHP explained: a process per request or permanent workers, the role of php-cgi and PHP-FPM, cgi settings and security rules.

https://phpsos.de/en/php/php-cli/2026-10-25T08:00:00+01:00

PHP CLI explained: differences from the web version, key options such as -l, -m and --ini, cron jobs, the built-in web server and why php -v often misleads.

https://phpsos.de/en/php/php-ini-erklaert/2026-10-25T08:00:00+01:00

The php.ini explained: where PHP looks for its configuration, which levels exist, what INI_SYSTEM and INI_PERDIR mean and which value applies in the end.

https://phpsos.de/en/php/release-zyklus/2026-10-25T08:00:00+01:00

PHP release cycle explained: a new version every November, two years of active support, two years of security fixes, end dates of all branches from 8.2 to 8.5.

https://phpsos.de/en/php/php-8-neuerungen/2026-10-25T08:00:00+01:00

What's new in PHP 8 from 8.0 to 8.5: key features per version, code examples, deprecations with upgrade risk and what is relevant for security.

https://phpsos.de/en/php/php-erweiterungen/2026-10-25T08:00:00+01:00

PHP extensions explained: core, bundled and PECL extensions, extension and zend_extension, php -m and why fewer modules are more secure.

https://phpsos.de/en/php/composer/2026-10-25T08:00:00+01:00

Composer explained: understand composer.json, composer.lock, vendor and the autoloader, deploy cleanly to production and maintain dependencies securely.

https://phpsos.de/en/php/php-frameworks/2026-10-25T08:00:00+01:00

PHP frameworks overview: what Laravel, Symfony, Laminas, Slim and others offer, how to choose one and what a framework means for security.

https://phpsos.de/en/php/cms-und-shops-auf-php/2026-10-25T08:00:00+01:00

Which CMS and shop systems run on PHP: WordPress, TYPO3, Shopware, Joomla, Drupal and more at a glance, with a way to check your own websites.

https://phpsos.de/en/php/php-und-datenbanken/2026-10-25T08:00:00+01:00

PHP and databases explained: PDO and mysqli compared, prepared statements, error handling since PHP 8 and secure credentials in day-to-day operation.

https://phpsos.de/en/php/sessions-und-cookies/2026-10-25T08:00:00+01:00

How PHP sessions and cookies work: session ID, storage, php.ini defaults, upload progress and the PHP2Shell interim measure.

https://phpsos.de/en/php/superglobals/2026-10-25T08:00:00+01:00

PHP superglobals explained: what $_GET, $_POST, $_FILES, $_SERVER and others contain, how PHP fills them before your code and how to use request data safely.

https://phpsos.de/en/php/datei-uploads-intern/2026-10-25T08:00:00+01:00

How PHP handles file uploads internally: multipart/form-data, temporary files in upload_tmp_dir, the $_FILES array, limits and error codes explained.

https://phpsos.de/en/php/typsystem/2026-10-25T08:00:00+01:00

The PHP type system explained: data types, type declarations from PHP 7.1 to 8.3, strict_types and loose comparisons, with examples and the security angle.

https://phpsos.de/en/php/fehler-und-exceptions/2026-10-25T08:00:00+01:00

PHP errors and exceptions: Throwable, Error and Exception, try/catch/finally, global handlers and safe settings for error display and logging in production.

https://phpsos.de/en/php/objektorientierung/2026-10-25T08:00:00+01:00

Object-oriented PHP: classes, interfaces, traits and enums, new language features from PHP 8.0 to 8.4 and the link to deserialization and security.

https://phpsos.de/en/php/namespaces-autoloading/2026-10-25T08:00:00+01:00

PHP namespaces and autoloading with PSR-4: from class name to file path, spl_autoload_register, the Composer autoloader and checks after an incident.

https://phpsos.de/en/php/psr-standards/2026-10-25T08:00:00+01:00

PHP-FIG PSR standards: all PSRs from 0 to 22 with status, the most important ones in practice and what PSR-3, PSR-4 and PSR-7 mean for security.

https://phpsos.de/en/php/speicherverwaltung/2026-10-25T08:00:00+01:00

PHP memory management made clear: reference counting, copy-on-write, cycles and the garbage collector, measuring functions and why PHP2Shell targets exactly this.

https://phpsos.de/en/php/out-of-memory/2026-10-25T08:00:00+01:00

PHP out of memory explained: how memory_limit counts, what happens internally on abort and what it means for CVE-2026-109618 and your servers.

https://phpsos.de/en/php/request-lebenszyklus/2026-10-25T08:00:00+01:00

The PHP request lifecycle explained: MINIT, RINIT, RSHUTDOWN, MSHUTDOWN, worker reuse and why CVE-2026-109619 targets exactly this point.

https://phpsos.de/en/php/jit-und-performance/2026-10-25T08:00:00+01:00

PHP JIT and performance in PHP 8: how the JIT compiler works with OPcache, which settings apply and why updates matter for both speed and security.

https://phpsos.de/en/php/php-testen/2026-10-25T08:00:00+01:00

PHPUnit and Pest explained: versions, first tests, useful test types and why tests make updates after PHP2Shell safer and faster for your business.

https://phpsos.de/en/php/statische-analyse/2026-10-25T08:00:00+01:00

PHPStan and Psalm explained: rule levels, baseline, taint analysis and what static analysis can and cannot do for secure PHP applications.

https://phpsos.de/en/php/eingebaute-sicherheitsfunktionen/2026-10-25T08:00:00+01:00

PHP security functions at a glance: passwords, randomness, escaping, cryptography, sessions and where their limits lie with flaws like PHP2Shell.

https://phpsos.de/en/php/php-lokal-entwickeln/2026-10-25T08:00:00+01:00

Local PHP development with the built-in server, Docker or DDEV: strengths, limits, examples and how development and production stay aligned on patch level.

https://phpsos.de/en/php/php-im-vergleich/2026-10-25T08:00:00+01:00

PHP compared with Node.js, Python and Java: execution model, operation, ecosystem and security. A factual overview for decision-makers and technical staff.

https://phpsos.de/en/php/php-sicherheitsprozess/2026-10-25T08:00:00+01:00

How the PHP project handles vulnerabilities: reporting via GitHub or security@php.net, severity rating, fix in the release and what operators should take from it.

https://phpsos.de/en/php/php-kompilieren/2026-10-25T08:00:00+01:00

Compiling PHP from source: prerequisites, configure options, signature verification, tests and why custom builds mean custom patching duties for you.

https://phpsos.de/en/php/php-in-containern/2026-10-25T08:00:00+01:00

Running PHP in containers: image variants, production php.ini, extensions, memory limits, logs and updates. With examples and the link to PHP2Shell.

https://phpsos.de/en/php/zukunft-von-php/2026-10-25T08:00:00+01:00

The future of PHP based on documented plans: support periods, PHP 8.6 with a planned date, accepted RFCs for PHP 9.0 and what this means for your planning.

https://phpsos.de/en/php/php-grundwissen-admins/2026-10-25T08:00:00+01:00

PHP basics for admins without a developer background: binaries, php.ini levels, FPM pools, key commands, logs and a checklist for after PHP2Shell.