PHP2Shell: Patching is mandatory. Modernizing is the opportunity.

What it can mean for your business

• Strangers take over your website

  Attackers can change content, serve malware to your visitors or plant fake forms. Under your name.

• Data leaks out

  One of the flaws can expose the server's memory: passwords, sessions, API keys. With those, attackers often get further than the website, into the CRM or other connected systems.

• Trust and obligations

  An incident on your website is public. If personal data is affected, a duty to report under the Swiss FADP or the GDPR can apply.

• Website offline

  Several organisations took their websites offline this week as a precaution. That is safe, but every day offline costs inquiries and visibility.

1. 01 Check the PHP version (php -v) and update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12.
2. 02 Restart PHP-FPM or Apache. Only then is the fix actually running.
3. 03 Still on PHP 8.1 or older? There are no official releases. Use your distribution's packages or move to a supported branch. PHP 7.3 and older get no fix at all.
4. 04 Remove temporary mitigations (memory_limit, session.upload_progress.enabled=0, WAF rules) after the update and check the logs for unusual multipart/form-data requests.

Sources: PHP security advisory of 21 October 2026, Tenable, Sansec. As of 23 October 2026.

php -v
sudo apt update && sudo apt install --only-upgrade 'php8.3*'
sudo systemctl restart php8.3-fpm   # or: apache2

• Open source, 0 CHF licence

  Umbraco and Oqtane are open source and run on current .NET. No licence fees and no vendor holding on to you.

• Code and hosting stay with you

  The website runs in your cloud and the code lives in your repository. Access and know-how stay in-house, even if we were gone tomorrow.

• One stack for everything

  If you already run .NET applications, your team can look after the website too. Same language, same tools and, if you like, one single sign-on.

• Customizable down to the detail. It is .NET, after all.

  Umbraco and Oqtane are not closed construction kits. Custom content types, blocks and editor extensions, integrations with your ERP, CRM or your own APIs: we write them in C# with the same tools as any other .NET application. No plugin zoo, just normal, testable code in your repository.

• We stay at your side

  We build together with your team, pass on our knowledge and take care of updates and further development within a clear monthly budget. When something is on fire, whoever is there first patches it.

What this looks like is shown by a current proof of concept: an existing PHP website rebuilt on Umbraco and .NET, with a multilingual editor, preview and automatic redirects from the old URLs. We cannot show the details publicly yet. A live demo in a call, we can.