.png)
Your website is the business card on the internet for all your customers and guests.
For this digital business card to run smoothly, security issues – even if they are annoying – must always be taken into account.
IT security not only deals with the protection of sensitive data but also with the potential misuse of the web server.
The takeover of the web server by an unwanted guest can have serious legal consequences for the website operator (in the worst case).
To better understand the risks, it is important to understand the background and connections. The following overview is intended to assist you.
(1) Who is responsible for updating PHP?
The server-level administrator
Your ISP (Internet Service Provider) will generally install a security patch for PHP. In the case of PHP2Shell, this will most likely already have been done. Please note: the provider is not the same as the programmer or web designer. The term “administrator” can sometimes lead to confusion.
(2) What is PHP2Shell vulnerability?
PHP is a programming language that enables dynamic pages on the web server.
PHP2Shell refers to two critical vulnerabilities in the PHP interpreter itself, through which attackers could execute code on web servers without login, sometimes even before the actual application runs. By cleverly exploiting a gap in the upload function. Even if the page consists only of /Hello World/ and offers nothing dynamic at all.
It is sufficient for PHP to be installed and enabled.
This means: The web server is hijacked, and sensitive customer data may be compromised or crimes committed in your name.
The problem has been known for 20 years, but it was considered too complex to be executable (in times without AI).
For those interested in the details, here is a successful video about it - easy to understand:
Watch the video: IT
PHP2Shell: How a Memory Error Becomes a Shell (https://youtu.be/qXv8NAIFm9o) (in German with English subtitles)
(3) Compatibility vs. Security - a Dilemma
What has been programmed once must also be maintained from time to time.
Even if your websites, for example, are independent of WordPress and similar (so-called CMS systems), they are not static and therefore require PHP. Only with /PHP/ is it possible to create pages dynamically (images and content are separate from HTML); otherwise, the effort to create them would be many times higher, and maintenance even more so.
By the way, PHP is an open-source project (Foundation) and originated from the diligent work of a few volunteers. PHP can be used without a licensing fee.
Currently, many PHP scripts still run on somewhat outdated PHP versions (7 and older). The few volunteers take care of the security updates. However, a current PHP version (8.5 - in 2026) is not a guarantee that everything on the website will continue to function. This is a dilemma (or one could almost say: Quite the opposite! Because with each upward update, there are, in addition to the security patches, sometimes significant changes in functionality (for example, commands may no longer work and need to be rewritten). This means that not everything we may have programmed for you five or ten years ago still works.
Therefore, in the medium term, this occasionally means that more or fewer adjustments in programming must take place, which unfortunately also incurs costs so that your customers and guests experience a functioning site.
This means that only pages that were perhaps programmed as static pages in pure HTML 20 years ago still run today (see above), but these pages unfortunately also look like websites did 20 years ago, and of course, no one wants that.
However, a dynamic website should last five years without major adjustments: After that? Either adjust or completely new. Such is the course of things.
(4) Observation and Maintenance of the Website
Your website is your business card on the internet for all your customers and guests.
To avoid excessive costs* and to keep the website running, it is important that you occasionally check your own company website (ideally 1 to 2 times a month) to see if everything is still functioning as intended. If not, a simple email with a brief description of the problem and a call to us (to ensure the email does not get lost) is sufficient. We will then discuss together which solution is best for you.
By following this approach, you not only avoid monthly fixed costs but also opportunity costs, as you largely ensure that your customers and guests are not accidentally faced with websites that no longer function (lost revenue).
(* For the German market, one can estimate in 2026 for annual contracts about 600 to 900 € net per month and website, which only includes actual 24/7 readiness with binding response times. Plus respective project work etc., similar to maintenance effort!)
We hope that with this information we could clarify a bit and bring some reassurance. Please contact us if you need further information.
