PHP runtime review · Upgrade planning · Functional testing
PHP Security Assessment and Patching
Know what needs fixing before changing your live website
Received a PHP security warning? Unsure whether your host has already applied the fix? CV Infotech helps you check the runtime serving your website, understand compatibility risks and plan the next step around the way your business works.
If your host handles the server patch, we can help scope the application checks and compatibility work it does not cover. Start with a scoped assessment. Any patching, code changes or post-update testing are agreed separately, so you know what is included before work begins.
See what the assessment includes
Share your website and concern first. No passwords needed. Scope and price are agreed before work starts.
Responding to the October 2026 PHP security update?
PHP has released fixes for two critical runtime vulnerabilities known as PHP2Shell. Your actual PHP package, hosting configuration and vendor patches determine what needs to happen next. A warning alone does not establish that your website was compromised.
Ask your responsible hosting provider or administrator to apply the official fix promptly; do not wait for a sales enquiry or a broader migration plan.
Read our October PHP security guide for the fixed releases and questions to ask your host.
Which situation sounds like yours?
“Our host sent a warning, but I don’t know what it means for us.”
We can review the provider’s response and available runtime evidence, identify who owns the update and explain any unanswered questions. If the host has already patched the relevant environment, the next step may be verification rather than another upgrade.
“We need to update PHP without breaking checkout, forms or logins.”
Compatibility matters as much as the version selected in a control panel. We scope the extensions, application dependencies and business-critical journeys that should be checked before and after an approved change.
“This is an older application and nobody wants to touch it.”
Start by establishing what runs, what it depends on and which parts still work. A small patch, a supported runtime upgrade and a larger migration are different jobs. The assessment gives you evidence for choosing between them.
“We manage several client sites.”
The scope can cover an agreed list of sites and environments, with responsibility and findings recorded per component. One patched account should not be assumed to cover every site, worker or separate deployment.
What the assessment includes
1. Runtime and hosting evidence
Identify the PHP runtime serving web requests, the hosting model and the relevant package or vendor security advisory. Record what was verified and what access limitations prevent us from checking.
2. Compatibility and dependency review
Review the agreed application areas, extensions and dependencies that could affect the proposed update. Flag compatibility work that needs its own estimate rather than hiding it inside a patching promise.
3. A practical remediation plan
Set out the recommended next steps, their priority and who needs to perform them. That may be your hosting provider, your existing developer or CV Infotech under a separately approved scope.
4. A test and release checklist
Define the journeys that matter to your site and the evidence needed after a change. Agree the backup, recovery and deployment responsibilities before touching production.
You receive a written findings report with the agreed coverage, evidence, unresolved items and recommended next actions. Remediation and retesting are included only where the scope explicitly says so.
Testing shaped around your application
WordPress and WooCommerce
Check the runtime alongside the theme, plugins and custom code. For a store, an agreed test plan can include product selection, cart, sandbox checkout, account access and order-related integrations. For a content site, forms, search, editing and key page templates may be the priority.
Laravel and custom PHP
Review framework and Composer dependencies, extensions, background jobs and integrations relevant to the update. Agree which authenticated workflows, APIs and scheduled tasks need regression checks. A framework update and a PHP runtime patch should not be treated as interchangeable.
Managed hosting or an existing development team
We can work from the evidence your provider or developer supplies and identify gaps that need their input. If direct verification is unavailable, that limitation stays in the report. We do not mark an inaccessible system as checked.
For a broader application review, see our code audit services.
Relevant website maintenance experience
Our work includes maintaining and improving existing websites where changes need to fit established functionality.
- Ultimate Fundraising Canada: a WooCommerce website redesign and ongoing website enhancements.
- xLocums: website updates and performance/SEO optimization work for a healthcare staffing business.
View our published project work.
Examples of ongoing development and maintenance work. Assessment scope is agreed for your environment.
A clear path from concern to decision
- Tell us what you run. Share the website address, hosting provider if known, and what prompted the enquiry.
- Agree the assessment. We confirm the scope, access arrangements, deliverables and price before starting.
- Review the findings. Understand the verified position, what remains unknown and the recommended work.
- Approve any changes. Patching or migration work proceeds only within an agreed scope and change plan.
- Check the result. Where implementation is commissioned, record the active runtime, agreed functional results and any remaining issues.
Questions before you enquire
Can you tell whether my website is affected from its public URL?
A URL helps us understand the enquiry, but usually cannot establish the active PHP build or vendor patch status. An assessment needs appropriate evidence and authorized access. Submitting the form does not trigger an automated scan of your website.
My hosting provider says it has fixed the issue. Do I still need help?
Ask which runtime and environments are covered, which vendor advisory confirms the fixes and whether the update is running. If that evidence is clear and your own team can verify the result, you may already have what you need. An assessment is useful when ownership, coverage or compatibility remains uncertain.
Is an assessment the same as a security audit or penetration test?
This is a bounded PHP runtime and upgrade assessment. The agreed scope defines the checks. It does not automatically include a full application security audit, penetration testing, incident forensics or a security certification.
Can you give us a price or completion time before checking the site?
We can agree the assessment price and scope first. A remediation quote depends on the hosting, access, compatibility and findings. Tell us about any business deadline so we can discuss it without promising a turnaround before the work is understood.
Will the update cause downtime?
That depends on the environment and change. The plan should cover testing, the deployment window and recovery. We do not promise zero downtime before assessing those constraints.
What if we think the website has already been compromised?
Mention that in your enquiry, without uploading logs or confidential data. Suspicious activity may require a separately scoped incident investigation and evidence-preservation process. Installing a patch alone does not establish that an existing compromise has been removed.
Tell us what you need checked
Not sure whether this is a hosting question, a PHP upgrade or a compatibility problem? Send the website and a short description. We will review the enquiry and discuss an appropriate scope before any paid work is agreed.
Include your website URL, hosting provider if known, and whether your concern is a security notice, an older PHP version or a problem after an update. Please do not include passwords, API keys, payment details, customer records or raw server logs.
Research note: PHP security guidance checked on 22 October 2026. See the official PHP security release notice and our dated update guide. No assessment can guarantee that a website is free of every vulnerability or compromise.