PHP2Shell: is your website patched?

Find the person who owns the answer

AWS warned on October 21 that AI-assisted analysis can shorten the time needed to develop exploits. It also reported pre-disclosure attempts against its sensors, while noting uncertainty about whether those attempts would have succeeded on real systems. For owners, that is a reason to verify patching promptly—not evidence that every PHP site is compromised.

Ask who maintains the server behind your website. Your designer, hosting provider and internal team may have different responsibilities. Resolve that boundary before accepting “we handle updates.” Record the responsible person, their escalation contact and who covers the work when they are unavailable.

Keep the conversation tied to your actual site. A general announcement from a provider is useful context, but it is not a record that someone checked your account. Ask for written confirmation and retain it alongside your maintenance agreement.

Send this to your host or maintenance team

“Please confirm our live PHP runtime is patched and that you reviewed PHP’s October 23 follow-up. Send the installed package or vendor-fix reference, completion time and any remaining action. Who owns that action, and when will it be completed?”

If the answer is unclear, ask for a named technical contact. Avoid guessing at server settings yourself. The useful outcome is a documented decision from the person responsible for the environment, not confidence borrowed from a reassuring email.

Close the handoff

Agree who will check the customer journey after maintenance, who can restore service if something breaks and who informs your team. Keep any unresolved work visible with an owner and deadline. A maintenance ticket should end with evidence and a clear handoff, not silence.