PHP vulnerabilities. What leaves your site exposed and how we patch it.
Unsupported versions, unpatched frameworks and plugins, old dependencies and configuration that reveals too much. Check what your site advertises for free, see this week's flaws and, if you want, we'll patch it with evidence.
It's rarely PHP itself. What exposes a site is running an unsupported PHP version, an unpatched framework or plugins, old Composer dependencies and a configuration that reveals too much. On a supported, up-to-date version, most published flaws already have a fix.
Unsupported PHP version
PHP 8.1 and older get no patches; PHP 8.2 gets them only until December 31, 2026, per php.net.
Unpatched framework
Laravel, Symfony or your CMS fix flaws only in supported versions. Laravel 11 no longer gets security fixes.
Plugins and themes
On WordPress, most break-ins come through flawed or abandoned plugins, not an updated core.
Composer dependencies
Old packages in «composer.lock». The «composer audit» command checks them against published security advisories (docs).
Configuration that reveals too much
«display_errors» on in production, «expose_php» advertising the version, «.env» files or backups anyone can download.
Your own code
SQL injection, unvalidated file uploads and weak sessions: the flaws described in the OWASP Top 10.
Which PHP versions still get security patches?
PHP gives each branch two years of active support and two more for critical security fixes only; after that, the branch is unsupported. These are the dates published on php.net as of October 30, 2026:
If you're on 7.4, 8.0 or 8.1, the PHP 8.4 upgrade guide explains what breaks in each version and how to migrate in stages without taking production down.
Which version does your site advertise?
Enter your domain and find out in seconds whether your PHP is vulnerable, losing support, or missing security headers.
We take you to the check with your domain filled in; there you confirm it's yours and run it. Read-only, no sign-up.
Which PHP, Laravel and WordPress flaws are out this week?
The latest from our weekly alerts, with affected versions and what to do. The most serious this month is PHP2Shell, already being exploited.
High
PHP 8.2
PHP 8.2 stops getting patches on December 31
Affected
Every system on PHP 8.2 or older. 8.1 has had no patches since December 2025.
What to do
Plan the move to PHP 8.4 before year end: review Composer dependencies and extensions.
From our weekly alerts (updated Oct 24, 2026). Primary sources only.See all alerts →
How do we patch your PHP?
With the Security OS method: first we see what you have, then we fix it with your approval, and finally we prove it with a before and after. If your site has already been attacked, start with the hacked WordPress guide or write to us.
From inventory to a patched server
01/ 06 · Inventory
01
Inventory
PHP versions on every server, Composer packages, plugins and themes, and the operating system underneath.
02
Priority
We match findings against published flaws and CISA's KEV catalog, and rank by real risk.
03
Upgrade plan
In stages, in a test environment first, with a rollback plan. If you need a new branch, we check compatibility.
04
Patching and hardening
We apply patches and harden PHP-FPM, the web server and configuration. Every change with its rollback and your approval.
05
Evidence
We run the same review before and after; you keep the comparison, flaw by flaw.
06
Monthly monitoring
We alert you to new flaws that affect your stack, with the patch ready.
What you get at the end
Inventory of PHP, Composer, plugin and server versions.
Prioritized list of flaws, with what was fixed and what's pending.
Before-and-after comparison from the same audit engine.
Not by itself. Flaws get fixed in supported versions; the risk is running an unsupported or outdated branch.
How do I know which PHP version I run?
On the server, with php -v. From outside, the free check reads whether your site advertises it in its headers.
Does hiding the PHP version protect me?
It makes you a little harder for bots to spot, but it fixes nothing. If the version is vulnerable, you need to update.
What happens to PHP 8.2 after December 31, 2026?
It stops getting official security patches. Any new flaw stays open unless your distribution publishes a backport.
Do you patch WordPress and Laravel too?
Yes. We update core, plugins, themes and Composer packages, test that the site still works and document every change.
Do you need access to my server?
To patch, yes, with the access you authorize. The assessment starts read-only and every change is applied only with your approval.
Review and drafting of legal documents is done with the support of legal specialists. WITS identifies needs and risks but does not provide legal services.
