PHP2Shell Compromise Check
From €290 per server
Olga Pascal, CEO
Attackers began targeting the PHP2Shell vulnerabilities on 17 October 2026, four days before PHP released the fix, and public exploits circulated within hours of disclosure. Installing the patch closes the hole. It does not remove anything an attacker left behind, such as a web shell in an upload directory or a modified PHP file.
The Compromise Check looks for those traces on each server in scope and gives you a clear answer per host: no indicators found, or indicators found with the evidence and what to do next.
What we check on each host
- PHP runtime version, SAPI and build, and whether the PHP2Shell fixes are actually present
- New or modified .php files in web roots, upload and temporary directories since 17 October 2026
- Known web shell patterns and obfuscated PHP code
- Web server and PHP error logs from 17 October 2026 for exploitation patterns (out-of-memory and fatal-error sequences, suspicious request bursts)
- Unexpected processes, cron entries and outbound connections running as the web server account
- New or changed users, SSH keys and scheduled tasks
- File integrity of the application against your repository or deployment artefact, where provided
What you receive
- Per-host result: No indicators found / Indicators found
- For any finding: file paths, timestamps, log excerpts and our assessment
- Recommended next steps
- A short summary you can forward to management, a customer or an auditor
What this check is not
This is a triage check for indicators of compromise. It is not a full forensic investigation and does not include incident containment, root-cause attribution or legal-grade evidence handling. If we find indicators of compromise, we stop, tell you immediately and recommend an incident response engagement.
What we need from you
Read-only access to the hosts in scope (SSH or an agreed alternative), access to web server and PHP logs from 17 October 2026, and, where possible, a reference copy of the application code.
Packages
Small estate
€790
excl. VAT
- Scope
- Up to 5 hosts
- Turnaround
- Within 4 business days
SEC-P2S-CC-5
Patch + Check bundle
€449
vs €519 separately
- Scope
- 1 host: emergency patch and compromise check
- Turnaround
- Patch: within 4 business hours. Check: within 2 business days
SEC-P2S-CC-B1
Prices exclude VAT where applicable. The check is read-only; we never ask for passwords in email.
Order a compromise check
Pick a package, leave your email and name, and tell us how many hosts are in scope. No prepayment: the invoice follows by email.
Prefer to talk? +373 22 843569
What next
Frequently asked questions
Exploitation attempts were seen from 17 October. If your server was reachable and unpatched in that window, a check is the only way to know.
WAF rules reduce exposure but do not fully block every exploitation path. The PHP project states that patching is the only complete fix.
We check what exists and state clearly in the report which periods could not be verified.
No. The check is read-only.