PHP2SHELL / SERVER SECURITY / FRESH MIGRATIONS
Recover your website.
Refresh the server beneath it.
Concerned about PHP2Shell or another server-side vulnerability? Siteroo can assess your recovery options and migrate suitable sites and applications to a fresh environment with updated images, runtimes and dependencies.
Discuss your server recovery ↗PHP2Shell.
Start with the environment.
PHP2Shell is associated with PHP core vulnerabilities CVE-2026-109618 and CVE-2026-109619. Updating WordPress, a theme or a plugin alone does not establish that the underlying PHP runtime has been patched.
We can review the PHP version and hosting setup, identify the relevant vendor fixes, assess available recovery copies and plan a maintained replacement environment. Exposure depends on the installed versions and configuration; an affected version is not proof that a server has been compromised.
If compromise is suspected, preserve logs and source copies before rebuilding. Plan credential rotation and review restored files and data. A fresh server should receive reviewed content and configuration, rather than an unexamined copy of the old environment.
Beyond PHP.
Node.js and the rest of your stack.
Server-side vulnerabilities can affect runtimes, frameworks, packages and the operating system beneath an application. We can scope reviews and migrations for PHP and Node.js applications, including their deployment images and dependency chains.
For example, Node.js’s 21 October 2026 security release addresses a Brotli decoder memory-safety flaw (CVE-2026-111497) that can permit remote code execution when an application decompresses attacker-controlled Brotli input. It also addresses DNS and TLS validation issues. Applicability depends on the runtime and application behaviour.
We check the relevant advisories against your actual stack, select a supported patched runtime and test application compatibility. Updating an npm package does not necessarily update Node.js itself or the base container image.
Advisory examples checked 27 October 2026. Versions and vendor guidance are rechecked when your project is assessed.
Node.js security advisory ↗A fresh server.
A planned move.
- Inventory and preserve
Record services, versions, databases, storage, DNS and email dependencies. Preserve backups and relevant logs before making changes.
- Build a maintained environment
Provision a fresh host, cloud instance or container image. Apply OS security updates, use supported patched PHP or Node.js runtimes, and rebuild dependencies from reviewed manifests and lockfiles.
- Restore and test
Migrate reviewed files and data, check dependency compatibility, access controls, background jobs and integrations, and verify HTTPS/TLS/SSL certificates, redirects and renewal.
- Cut over with a way back
Agree the migration window, validate DNS and the live application, retain a rollback plan and establish independent backups and an ongoing update process.
Keep the features.
Reduce unnecessary exposure.
For a content site or blog, a static rebuild can remove the public PHP runtime. For stores, accounts, APIs and other dynamic applications, we can plan the server and dependency migration around the features you need to retain.
A migration is not evidence that a compromise has been fully investigated. Where forensic investigation or active incident response is needed, that work must be scoped with an appropriate specialist alongside the recovery.
Explore content and WordPress recovery ↗Tell us what you’re running.
Share your platform, hosting provider, affected service and available backups. Start without passwords or secret keys; we’ll agree the assessment and migration scope first.
Plan a fresh migration ↗Already planning a project?
Select server migration and the security audit options in the starter planner.
Create a starter brief ↗