In short: Affected? Call us. We help. Mid-sized companies often lack a security department of their own, and that is exactly what we are here for: from the first message we remotely take over first aid for your web servers, preserve evidence, close the vulnerability, clean up and document until the incident is closed.
Do not delete anything and do not rebuild anything right now. That applies even if operations are pressing and the website is supposed to run again. First secure, then repair. Report an emergency and we will tell you what you can safely do yourself.
Are You Affected? The Typical Situation in Mid-Sized Companies
If you run a company with 20, 200 or 800 employees, you usually have one or two people for IT, an agency for the website and a host for the server. That is normal, but in an emergency it makes gaps visible. Acute exposure is likely if:
- Your website, customer portal or online shop runs on PHP and nobody knows for certain which version exactly.
- A host, a customer or a browser warning reports irregularities.
- Your admin reports that files or accounts on the web server cannot be explained.
- You do not know which systems are publicly reachable at all.
- The web server has access to internal systems, databases or file shares.
Trade press cites as background that almost all PHP versions may be affected: according to reports, versions back to PHP 5.4 are affected. What the situation looks like in mid-sized companies is described on the page IT security for mid-sized companies and industry.
What to Do Right Now
- Form a crisis team. Management, IT and, if applicable, data protection: a few people, one decision maker.
- Collect the systems. Which servers, websites and portals are affected or could be? A simple list is enough.
- Change nothing. No cleanup actions, no reinstallation, no restoring of backups.
- Have connections checked. Is the web server attached to the internal network? Then an attack on the website can affect more than just the website.
- Approach host and agency. Ask both to keep logs and to confirm status and responsibilities. How is described under How to ask your host about the patch status.
- Secure access. Change passwords and keys only after consultation and from clean devices.
- Get in touch now. Call us or write to us on WhatsApp.
First Aid for Web Servers: How We Proceed in Mid-Sized Companies
A mid-sized business cannot afford standstill, but also not an uncontrolled intervention. That is why we work in stages that disturb ongoing operations as little as possible:
- Stage 1, isolate: We clarify whether the affected servers must be restricted temporarily. For PHP2Shell, the BSI (German Federal Office for Information Security) recommends taking web servers offline if an update is not immediately possible.
- Stage 2, secure: We secure logs, files and databases so that the incident remains provable.
- Stage 3, fix: Patch or configuration, restart of all PHP processes, closing unknown access.
- Stage 4, check: We search the system and its surroundings for traces and consequential damage, including adjacent servers.
A decisive point for decision makers: a CMS update, for example of WordPress, does not close the PHP vulnerability, and a patch does not remove malicious code that has already been planted. Anyone who says "done" after the update has not done half of the work.
Typical Mistakes in Mid-Sized Companies in the First Hours
From practice, a few patterns are known that enlarge the damage. First, responsibility is passed back and forth: the host points to the customer, the agency to the host, the admin to management. So decide early who decides. Second, restoring happens too fast. Restoring an old backup without closing the entry point brings the attacker straight back. Third, communication gets neglected: employees, customers and business partners learn of the incident second-hand.
Under Crisis communication after an attack you will find notes on how to handle this calmly. As a rule of thumb: better to say little, but to say it with evidence.
How Does PHP SOS Help?
- Assess the situation: With you we clarify the systems, the operating mode (PHP-FPM, mod_php or LiteSpeed), the data and the contact persons. A first overview emerges quickly, even without detailed knowledge.
- Secure and close: We preserve traces and close the entry point without needlessly disturbing your processes.
- Check and clean up: Webshells, backdoors, cron jobs and foreign accounts are searched for and removed. Details under Having malware and webshells removed.
- Harden and report: You receive a report for management, data protection and insurer. On request we build up the precautions with you, for example through a security maintenance contract.
If the incident grows beyond one web server, we move into structured incident response.
Afterward: Precautions Without a Security Department of Your Own
Once the incident is closed, the question remains how you can prevent the next one or at least detect it earlier. For companies without their own security team, four things matter most: a current inventory of all websites and servers, a clear contact person for updates, tested backups and a short IT emergency plan.
Whether your company falls under the duties of NIS2 is a legal question that we do not answer. You will find general information on our page; the classification is made by a lawyer or data protection officer.
What You Should Send Us
- a short account of the incident and when it occurred
- a list of the websites, shops and portals with host and, as far as known, PHP version
- names of the admin, agency and host who know the system
- notes on whether the web server is connected to internal systems
- details of backups and of any existing cyber insurance
Why PHP SOS
We work Made in Germany and, together with our partner network of cyber professionals, have specialized in IT security for over 25 years. For you that means one contact instead of many, remote work with no travel across Germany and Europe, and documentation with which you hold up toward customers, insurer and authorities. We openly separate what is proven, probable and unknown, and we promise nothing that nobody can keep.
Affected? Call Us. We Help.
For first aid you do not need a security department of your own, but a contact who gets started. We take over from the first message and stay with you until the incident is closed and documented. Report an emergency now.
Frequently asked questions
What should we do about a cyberattack without our own IT security department?
Preserve evidence, delete nothing, name a decision maker and get outside help. A mid-sized company does not have to be able to do everything itself. We take over the technical side and work together with your admin, your agency or your host.
Are small and mid-sized companies even targets of attacks?
Yes. Automated scans look for unpatched servers without regard to company size. For PHP2Shell, Palo Alto Networks (Unit 42) counted more than 22.6 million exposed, potentially vulnerable instances.
Does our business have to stop if the web server was attacked?
Not necessarily. Often the website and shop can be isolated while internal systems keep running. First we clarify whether there are connections between the web server and your internal network.
Does NIS2 apply to us and what does it mean in an incident?
Whether your company falls under NIS2 depends on sector and size and is a legal question. Our page on NIS2 gives an overview; the classification for your case belongs with a lawyer or data protection officer.
How do we prepare for the next incident?
With an inventory of systems, a named contact person, tested backups and a short emergency plan. We help with setting this up once the acute incident is closed.