.png)
Your website is the online business card for all your customers and visitors.
To keep this digital business card running reliably, security issues must also be addressed regularly—even if this can feel like a chore.
IT security is not only about protecting sensitive data, but also about the potential misuse of the server. A server being taken over by an unwanted guest can have serious criminal-law consequences for the server operator (in the worst case).
To better understand these risks, it is important to know the different types of malicious software and the methods attackers use to try to obtain confidential information. The following overview first explains the key definitions of the various categories and terms.
(1) Who is responsible for updating PHP?
The server-level administrator
Your ISP (Internet Service Provider) will generally install a security patch for PHP. In the case of PHP2Shell, this will most likely already have been done. Please note: the provider is not the same as the programmer or web designer. The term “administrator” can sometimes lead to confusion.
(2) What is PHP2Shell vulnerability?
PHP is a programming language that enables dynamic pages on the web server.
PHP2Shell refers to two critical vulnerabilities in the PHP interpreter itself, through which attackers could execute code on web servers without login, sometimes even before the actual application runs. By cleverly exploiting a gap in the upload function. Even if the page consists only of /Hello World/ and offers nothing dynamic at all.
It is sufficient for PHP to be installed and enabled.
This means: The web server is hijacked, and sensitive customer data may be compromised or crimes committed in your name.
The problem has been known for 20 years, but it was considered too complex to be executable (in times without AI).
For those interested in the details, here is a successful video about it - easy to understand:
Watch the video: IT
PHP2Shell: How a Memory Error Becomes a Shell (https://youtu.be/qXv8NAIFm9o) (in German with English subtitles)
(3) Compatibility vs. Security - a Dilemma
What has been programmed once must also be maintained from time to time.
Even if your websites, for example, are independent of WordPress and similar (so-called CMS systems), they are not static and therefore require PHP. Only with /PHP/ is it possible to create pages dynamically (images and content are separate from HTML); otherwise, the effort to create them would be many times higher, and maintenance even more so.
By the way, PHP is an open-source project (Foundation) and originated from the diligent work of a few volunteers. PHP can be used without a licensing fee.
Currently, many PHP scripts still run on somewhat outdated PHP versions (7 and older). The few volunteers take care of the security updates. However, a current PHP version (8.5 - in 2026) is not a guarantee that everything on the website will continue to function. This is a dilemma. Because with each upward update, there are, in addition to security patches, sometimes significant changes in functionality (for example, commands may no longer work and need to be rewritten). This means that not everything we may have programmed for you five or ten years ago still works.
Therefore, in the medium term, this occasionally means more or less many adjustments in programming, which unfortunately also incurs costs so that your customers and guests experience a functioning site. This means that only pages that were perhaps programmed as static pages in pure HTML 20 years ago still run today (see above), but they also look /like 20 years ago/ (which no one wants). A dynamic website should, however, last five years without major adjustments. After that, either adjust or completely new. Such is the course of things.
(4) Observation and Maintenance of the Website
Your website is your business card on the internet for all your customers and guests.
To avoid excessive costs* and to keep the website running, it is important that you occasionally check your own company website (ideally 1 to 2 times a month) to see if everything is still functioning as intended. If not, a simple email describing the problem and a phone call to ensure the email does not get lost is sufficient. We will then discuss together which solution is best.
(* For the German market, one can estimate in 2026 for annual contracts about 600 to 900 € net per month and website, which only includes actual 24/7 readiness with binding response times. Plus respective project work etc., similar to maintenance effort!)
We hope that with this information we could clarify a bit and bring some reassurance. Please contact us if you need more information.
