Website security
Protecting your website, your business and your customers' data.
Most websites aren't hacked by someone who has picked them out. They're found by automated tools that scan the internet around the clock for software with a known weakness.
When a serious vulnerability is published, attackers can be exploiting it within hours. A popular platform like WordPress, or even PHP itself, means a single flaw can be used against millions of sites at once. And the consequences of a breach go beyond downtime: under UK law, a leak of personal data can mean reporting obligations, fines and lasting damage to your reputation.
We keep websites patched, recover them when the worst happens and audit them to find weaknesses before attackers do.
PHP2Shell: why "up to date" means more than your CMS
In October 2026, two critical vulnerabilities were found in PHP itself, the language behind WordPress, Laravel, Drupal, Magento and most of the web [4].
Known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), the flaws allow an attacker to run their own code on a web server without logging in [1]. Details leaked online on 20 October, before a fix was available, and PHP released patched versions the following day [2]. Attacks followed almost immediately [3].
- 70%
- Of websites run on PHP, the language affected
- 9.2
- Critical CVSS severity score
- 0
- Logins needed to exploit it
What makes PHP2Shell important is that a website could have its CMS, plugins and theme fully up to date and still be vulnerable. The fix had to be applied to the server, not the website.
We patched the servers we manage within 12 hours of the fix being released. If your website runs on PHP and you're not sure whether your hosting has been updated, get in touch and we'll check it for you.
How do you prevent most hacks?
Keep everything up to date. Not just the website, but the server it runs on.
Attackers rely on sites that haven't installed fixes that are already available. The sooner a patch is applied, the smaller the window they have.
What we keep up to date
A website is built in layers, and a weakness in any one of them can let an attacker in. Through our website support, we keep every layer patched, not just the parts you can see:
-
01
Server and operating system
-
02
PHP, as PHP2Shell showed
-
03
Code libraries and dependencies
-
04
CMS core, such as WordPress, Drupal or Joomla
-
05
Plugins, themes and extensions
-
06
Admin accounts, access and backups
For custom-built sites, such as Laravel applications, we monitor the libraries they depend on for security advisories. Updates can occasionally break older sites, so we test major updates before they go live and take regular off-site backups so recovery is quick if anything goes wrong.
Fixing a hacked website
Even well-maintained websites can fall foul of attackers. Getting your site back online is always the top priority. Every hour it's down you're losing customers, and if it stays compromised for long it can be blacklisted by browsers and search engines.
Our process for fixing a hacked website:
Take the site offline or restrict access, so the attack can't spread or harm your visitors.
Work out how the attacker got in, what they changed and whether any data was accessed.
Restore from a clean backup where one exists, or remove malicious code and files where it doesn't.
Close the hole they came in through, update everything, reset credentials and take fresh backups.
Put the site back live, request blacklist removals and monitor closely for reinfection.
Website security audits
If your website stores personal information, you need to know it's secure. Many business owners understandably assume their web developer built the site securely. Sadly, that isn't always the case.
We've taken on websites exposing personal data to Google searches, and even one with passport scans publicly accessible, all supposedly built by professionals.
Our security audits look at:
- Software and patching - Out-of-date CMS, plugins, PHP versions and dependencies with known vulnerabilities.
- Code - Common weaknesses such as injection, insecure uploads and broken access control.
- Data exposure - Whether personal or sensitive data can be reached by people who shouldn't see it, or by search engines.
- Access - Who can log in, what they can do, and how passwords and accounts are managed.
- Hosting and configuration - Server settings, SSL, backups and how well the site is isolated from others on the same server.
You'll get a clear report with prioritised actions. We can make the changes for you, or work alongside your existing developer.
Why Webbed Feet for website security?
We're developers
We don't just run a scanner. We understand the code, so we can find the real cause and fix it properly.
We act fast
When PHP2Shell was patched, every server we manage was updated within 12 hours.
Cyber Essentials certified
We hold ourselves to the same standards we recommend to our clients.
Website security FAQs
If your website runs on PHP and the server hasn't been updated since 21 October 2026, it may be. That includes WordPress, WooCommerce, Drupal, Joomla, Magento and Laravel sites.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or later [2]. If you're unsure, ask your host or get in touch and we'll check for you.
It's a big step, but not the whole picture. PHP2Shell affected the server software rather than the website, so fully updated sites were still at risk. The server, PHP version and any code libraries need to be kept up to date too.
Contact us as soon as possible. Don't delete files or restore old backups yourself until you know how the attacker got in, or you risk losing evidence and being reinfected.
If personal data may have been accessed, you may also need to report it to the ICO within 72 hours [5].
Yes. Many of the sites we support were built by someone else. We'll start with a review so we know what we're working with. Find out more about our website takeovers.
Yes. We can audit a website on its own, or as part of a wider technical audit, and then help with any fixes needed.
Sources
-
Sophos advisory: PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619)
https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell -
Qualys: PHP announces critical security release for two vulnerabilities
https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities -
BleepingComputer: PHP2Shell security flaws now successfully exploited in the wild
https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/ -
W3Techs: Usage statistics of PHP for websites
https://w3techs.com/technologies/details/pl-php -
ICO: 72 hours - how to respond to a personal data breach
https://ico.org.uk/for-organisations/sme-web-hub/72-hours-how-to-respond-to-a-personal-data-breach
01722 346400
