PHP development & maintenance
PHP Upgrade Services & Security Updates
Is your website running on an outdated or unpatched version of PHP? We check your setup, fix compatibility issues and manage the upgrade, with testing before anything goes live.
Smart Web Agency provides PHP upgrade services for WordPress, WooCommerce, Laravel, OpenCart, Drupal, Joomla, Moodle and bespoke applications. Whether your hosting company has sent a warning, a plugin needs a newer version of PHP or the PHP2Shell vulnerabilities need urgent attention, we can explain what needs to change and handle the work for you.
Security update · Reviewed 26 October 2026
PHP2Shell: check your server has been patched
- On 21 October 2026, PHP fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell.
- Under certain conditions, they let an attacker run code on a web server without logging in.
- All PHP installations serving web requests are at risk, not just old versions.
- The fix is PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a patched package from your hosting provider.
- Updating WordPress, your plugins or your firewall does not fix it. PHP itself must be patched.
- Separately, PHP 8.2 stops receiving security fixes on 31 December 2026.
Your website can still work on outdated PHP
A website does not have to look broken to need attention. Your pages may load normally while the software behind them is no longer receiving routine security fixes.
Older PHP versions can also hold back updates to your CMS, plugins and integrations. Eventually, a hosting change or a plugin update can expose problems that have been building up for years.
We check the website and the hosting together. You receive a clear explanation of the risks, the work required and the cost before we begin the upgrade.
Our PHP upgrade services
PHP version and hosting checks
We identify the PHP version serving your website, review the hosting configuration and check patch availability. Where your hosting provider manages the server, we work with them to confirm what has been applied.
WordPress and WooCommerce upgrades
We check your theme, plugins and custom code against the proposed PHP version. Testing covers the parts your customers rely on, including enquiries, checkout, payments and account access.
Laravel and bespoke PHP applications
We review framework requirements, Composer dependencies and custom functionality. This includes scheduled tasks, background processes and API connections that may not be visible on the website itself.
Legacy code and compatibility fixes
Old code can prevent a straightforward upgrade. We identify what needs updating or replacing and explain the options, including where a larger framework or CMS upgrade is required.
Urgent PHP security updates
If a security advisory affects your website, we assess the immediate patching options with your hosting provider. If it cannot be patched promptly, we discuss restricting access while the issue is addressed.
Ongoing maintenance and support
After the upgrade, we can continue looking after your website with software updates, backups, monitoring and development support under an agreed maintenance plan.
How we manage your PHP upgrade
Review the current setup
We assess your PHP version, CMS or framework, hosting and integrations. We separate urgent security work from the wider upgrade so you know what needs attention first.
Agree the scope and cost
We explain the recommended version, compatibility work and expected timescale. You know what is included and whether anything depends on your hosting company or another supplier.
Prepare and test
We take backups and use a separate staging environment to test the upgrade. We fix the agreed compatibility issues and check the main user journeys before deployment.
Deploy and verify
We agree a suitable deployment window, apply the changes and check the live website. You receive a summary of the updates, testing and any remaining recommendations.
For urgent security incidents, we agree an accelerated response with your hosting provider. Temporary access restrictions may be needed while patching and checks are completed.
Case Studies
Why work with Smart Web Agency?
We develop and maintain websites as well as the systems connected to them. That matters when a PHP upgrade affects more than the pages visitors can see.
Your website may send enquiries to a CRM, take subscription payments, process bookings or exchange data with an internal system. We include those connections in the agreed testing scope.
Based in Ashford, Kent, we support organisations across the UK and internationally. You can speak directly with our team, understand the work being done and get help after the upgrade.
We can also review websites built by another developer. We start by understanding the existing code and access available, then recommend a practical way forward.
How much does a PHP upgrade cost?
The cost depends on the age of your website and how much needs to change. A maintained WordPress site may need a version update and testing. An older bespoke application may need code changes, dependency updates or a framework upgrade first.
Send us your website address, hosting details and any warning you have received. We will review the requirement and provide a clear estimate before starting the work.
Frequently Asked Questions (FAQs)
Your hosting control panel usually shows the PHP version assigned to your website. Ask your provider to confirm the version actually serving requests and whether vendor security patches are installed. We can help review this information.
Choose a supported release compatible with your website and dependencies. We check the current PHP support schedule and your application requirements before recommending a version. A recent security patch and a longer term upgrade may be separate pieces of work.
No. WordPress updates change the application. PHP is managed through your hosting environment and needs its own updates.
Compatibility problems are possible, particularly with older plugins or custom code. We test in staging and resolve the agreed issues before deployment. We also prepare a recovery plan and explain any remaining risks.
We plan the work to minimise disruption. Some upgrades need a short maintenance window, while an urgent security issue may require temporary restrictions. We explain this before making changes.
A firewall can help reduce exposure to some attacks, but it does not repair vulnerable server software. PHP patches still need to be applied.
Yes. We can assess the incident, investigate affected files and help with recovery. Patching PHP alone does not remove malicious code or resolve compromised credentials, so recovery needs its own scope.
Not necessarily. We can work with your existing provider if they support the required PHP version and configuration. If the hosting prevents a suitable upgrade, we explain the alternatives.
Include PHP in regular website maintenance and review security advisories as they appear. Plan version upgrades before support ends, and prioritise critical patches rather than waiting for an annual review.
Need help updating PHP?
Send us your website address and any message from your hosting provider. We will explain what needs checking and the next steps for your website.