PHP security emergency, October 21, 2026
Type your website address. In a few seconds you get a plain-English answer: what your site runs on, what your hosting provider has said, and what to do next. No login, no download, nothing is changed on your site.
This reads only what your site shows the public, the same things any visitor's browser sees. It cannot see your hosting panel, your backups or your admin accounts, and many hosts hide version numbers on purpose. A clear result here is a good sign, not a certificate.
If you want it handled
I'm David Lamond, founder and developer at AV Labs. I build websites, apps and AI workflows, and I work alone, so you deal with me from the first message to the final report. Fixed prices, agreed scope, no surprises.
Practical security basics, done carefully and in writing. Specialist problems (a site that has already been broken into, servers I have not worked on, payment systems) are referred to specialists, and I will tell you when that is the case. No one can promise complete protection, and I won't. Paid software and work outside the agreed scope are agreed separately. Hiring and payment can also be arranged through Upwork.
Primary sources
PHP security advisory: php.net
UK National Cyber Security Centre: ncsc.gov.uk
US CISA: cisa.gov
Hosting provider statements are quoted with their date and source in each result.