Oakshield Book a call
Menu

PHP security engineering

About Oakshield

Last updated:

We verify and document PHP patch status for businesses and the agencies that run their sites. We’d rather show you how we work than ask you to take our word for it.

Patched. Proven. Maintained.

Patched

We check that every PHP runtime runs a fixed release or a vendor backport, with the settings that close what’s still open, and give you the exact steps for anything that doesn’t.

Proven

Every status is per CVE, as of a UTC time, with an evidence level and the open issues listed. A version number is never the evidence.

Maintained

Exposure returns with the next advisory. The Verification Plan re-checks every quarter and after the next critical PHP flaw, so the record stays current.

How we’re accountable

Why this work matters now

Attacking got cheaper

In October 2026, Reuters reported that one attacker used AI agents to try to break into more than 1,200 websites and broke into sites belonging to more than 100 companies, at an estimated $50 per successful break-in. Anthropic reported that AI is cutting attackers’ labor costs while payoffs stay the same, which makes lower-value targets worth attacking.

Speed changed too. According to Patchstack, a WordPress security vendor, the median time to mass exploitation for the most heavily exploited WordPress flaws was 5 hours. Microsoft puts the median time from a vulnerability’s discovery to working attacks at under 24 hours. Google’s Mandiant estimates that in 2025, on average, attackers were exploiting vulnerabilities before a fix was available.

Then PHP2Shell

On October 21, 2026, PHP shipped emergency fixes for two critical flaws in the PHP engine itself. Amazon had already seen exploitation attempts four days earlier. CISA advised taking systems offline where they can’t be patched; the UK NCSC advised considering it if temporary mitigations can’t be applied in time. Japan’s Prime Minister made what she called an “extremely urgent request”.

Many shared and managed hosts reported patching their managed plans. Everyone on their own servers had to do it themselves. Then came the question few could answer quickly: is the fix actually running? Backports keep old version numbers, and workers need restarting. Two days later, a related flaw arrived that the releases didn’t fix.

What didn’t change

The weaknesses are old and fixable. In the cases Anthropic disrupted, attackers mostly got in through unpatched websites and content-management systems, VPN and edge devices, and exposed secrets, not fundamentally new techniques. AI-discovered bugs aren’t exploited more often than others. Anthropic reported in September 2026 that attackers were still heavily involved in choosing targets. The right response is neither panic nor a rewrite. It’s maintenance, done at the speed attacks now move.

What we believe

“Get off PHP” is the wrong advice. Get off unmaintained PHP. PHP runs 69.3% of websites with an identifiable server-side language. The risk sits in runtimes that no longer get fixes, in plugins nobody updates, and in the hours between a fix and an attack. Patch first. Shield while you patch. Harden so the next one hurts less. Modernize on your schedule, for business reasons.

Company details

Legal entity
Luven Technologies LLC. Oakshield is a trade name of Luven Technologies LLC.
General enquiries
hello@oakshield.co
Quotes and partners
sales@oakshield.co

Your website, accounted for.

Want a signed answer?

Read-only access, one business day, a signed per-CVE report.

Book a call Read the sample report

Sources

Every figure and quotation on this page links to its primary source. All of them, with the date we last checked each: full wording and methods.