A critical hole in PHP, the engine under most WordPress, Joomla and Drupal sites, lets a stranger in with no password to run code on your server and pull customer logins and keys out of its memory. The fix shipped October 21. Most small business sites have not applied it, and about 1 in 3 WordPress sites run a PHP version that will never get it.
Takes 30 seconds to request. If your site is already safe, we tell you, show you the version, and that is the end of it. No scare tactics, no retainer pitch.
Three taps. You get a straight verdict and, if you need one, your exact price. No email required to see your result.
Three honest buckets. Find yours, then act accordingly. We would rather lose a sale than sell a fix to someone who does not need one.
Your site sits on PHP. If you have not deliberately updated PHP since October 21, you are almost certainly running a vulnerable version right now. This is who the free check is for.
No official patch exists for your version and none is coming. Your only fix is an upgrade to PHP 8.2 or newer, done carefully, because old plugins can break. That is our Hard Case service below.
Those platforms run their own servers and handle this themselves. Relax. Same if a quality managed host confirms in writing that they deployed the October 21 PHP release. Ask them for that confirmation today, it is free and it is your proof.
In WordPress, go to Tools then Site Health then Info then Server. Find the PHP version line. Below 8.2.35, 8.3.36, 8.4.27 or 8.5.12 for your branch means exposed. On 8.1 or lower means no patch exists for you.
Send us your website address. We check the version your site announces publicly, using the same method as OpenAI's published php2shell checker. No login, no password, no access to your site. You get a plain-language verdict: safe, exposed, or cannot tell from outside, with the exact next step either way.
Attackers do not pick small businesses by hand. They scan the whole internet automatically, and this hole is now public, documented and being tried. Patching after a takeover costs many times more than patching before one, and it starts with cleanup, not an update.
No login needed. One crafted request can be enough on the most common setups. From there they can change your pages, add hidden admin accounts and redirect your customers.
The second bug can expose other visitors' passwords, session tokens, API keys and certificates sitting in server memory. For a store or a clinic, that is customer data, not just a website problem.
Public services in three European countries went dark as a precaution this week. Hosts suspend compromised sites every day. A planned, backed-up patch tonight beats an emergency takedown during your busiest week.
Every day unpatched is a day the scan can find you first. Get checked free today.
Remote, careful, and proven at the end. You never hand over a password for the free check, and nothing changes on your site before a backup exists.
You send your website address. We check your exposed PHP version and tell you plainly: safe, exposed, or needs a two-minute inside look. No charge, no obligation, no password.
If you are exposed, you get one fixed price before any work: CA$197 for a standard patch, or a quoted price from CA$349 if your site needs a full version migration. No hourly meter, no surprises.
Full backup first, stored off your server. PHP updated to a patched version, server restarted, WordPress and plugins updated in safe order, then your homepage, contact form and checkout are tested like a customer would use them.
You receive before-and-after versions, what was tested, and where your backup lives. If anything breaks from the upgrade, we roll back free. You pay when the site is live and working on the safe version, not before.
Canadian dollars. Priced for small businesses, not enterprise budgets, because small businesses are exactly who this hole hits.
After your patch: optional Aftercare, CA$49 per month per site. Monthly updates, backups and version monitoring, and the next emergency patch applied for you. Offered after your fix is delivered and proven, never pushed before.
The check is free, needs no login and no password, and comes with a straight answer even when the answer is "you are already safe, you owe us nothing." If your host already patched you, we will tell you that and walk away.
If the upgrade breaks your site, we restore the backup free and you do not pay until your site is live and working on a patched version. That is written into every job before it starts. We never promise any site can never be attacked. We promise this specific hole gets closed, with proof.
No. Those updates do not touch PHP itself. The hole sits in the engine underneath your site. Only a PHP update to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer in your branch closes it, followed by a server restart.
Good hosts deployed this patch already. Ask yours one question in writing: "When did you deploy the October 21, 2026 PHP security release, and do I need to do anything?" If they answer clearly, you are likely covered, and our free check can confirm the version your site announces. If they cannot answer, you have your answer.
Many sites hide their PHP version from the public, which is good practice. It also means nobody, including an attacker or us, can read it from outside. In that case the check takes two minutes inside WordPress at Tools, Site Health, Info, Server, and we walk you through it or do it with temporary access you control and can revoke.
It can, which is exactly why a full backup comes first, branch upgrades are tested on a staging copy, and rollback is free. Most sites on PHP 8.2, 8.3 or 8.4 only need the small security update in their own branch, which is the lowest-risk change there is.
Yes, but patching alone is not cleanup. Tell us what you are seeing in the check form. Cleanup is quoted separately after a look, and because this bug can leak passwords and keys from memory, we will advise rotating them. No judgement, it is happening to businesses everywhere this week.
Kollaz is based in Ottawa. The work is done remotely, in the evening so your business day is never disrupted. You deal with a named local person, a fixed price in writing, and a proof pack at the end, not an anonymous ticket queue.
Send your website address. No login, no password, no obligation. You get a plain-language verdict and, only if you need it, one fixed price to close the hole with proof.