Critical PHP vulnerability? We'll secure and clean up your site.

Yes, if the server uses a vulnerable PHP version. The vulnerability is in PHP itself, not in WordPress — according to WordPress.org, no WordPress update is required or planned for it. A new version of WordPress, a plugin or a theme, or a security plugin, won't close this hole.

Only a PHP update helps — to a fixed version (8.5.12, 8.4.27, 8.3.36 and 8.2.35) or a later release of the same branch. How to check your version is explained above, under “Am I affected?”.

Probably, but check two things. First, which PHP version your domain uses: hosts usually let you choose one of several, and the PHP team released no new versions for 8.1, 8.0, 7.4 and older. Ask your host to confirm in writing that the version serving your domain includes the fixes.

Second, whether anyone broke in before the update. Information about the vulnerabilities leaked on 20 October 2026, and an update doesn't remove backdoors planted earlier.

The PHP team released no new versions for these — it only published source-code patches for people who build PHP themselves. Some Linux distributions and extended-support vendors may ship their own fixes, but until your host confirms this in writing, treat your site as unprotected.

The proper fix is moving to a supported version — ideally 8.3 or later, since support for PHP 8.2 ends on 31 December 2026. Old plugins, themes and custom code may need fixes, so we test the site on a copy first. We quote the move before we start.

An update within the same version — e.g. from 8.3.35 to 8.3.36 — contains only bug and security fixes, so it usually doesn't change how the site works.

Moving to a newer version — e.g. from 7.4 to 8.3 — is different: old plugins, themes or custom code may stop working. That's why we first make a full backup and test a copy of the site on the new PHP version, and switch the live site over only once everything works.

It's the most important step — it closes the hole. But it doesn't remove anything the attackers may have left behind before: backdoors, unknown accounts or cron jobs. Nor does it invalidate passwords and keys that may have leaked from server memory.

So after the update, check for the signs of a hack listed above and change the passwords for your site's admin panel, hosting and email. The database password and API keys have to be changed in the site's configuration at the same time (in WordPress: in wp-config.php and plugin settings), or the site or payments will stop working. If you prefer, we'll do it for you as part of the hardening service.

A firewall is good temporary protection, but it doesn't replace the update. Cloudflare has deployed rules that block the known attack methods, but Cloudflare itself calls them a stopgap — attackers look for ways around them.

A firewall also only protects the traffic that goes through it: if the server accepts direct connections too, an attacker can bypass it. Update PHP anyway.

We quote hardening before we start: a fixed amount counted in full hours at PLN 369 incl. VAT (PLN 300 net) per hour. The number of hours depends on whether an update within the same PHP version is enough or a move to a newer one is needed, and on how many sites are on the server. We give you the amount in the offer after the free diagnosis.

Cleaning up a WordPress site costs from PLN 738 incl. VAT (PLN 600 net) — in fixed-price packages: blog or simple site PLN 738, company website PLN 1,476, online store PLN 2,460 incl. VAT. Infections spread between sites on one hosting account, so we clean them together: you pay the full package price for one site only — the one with the most expensive package — and each additional infected site you want to keep costs 50% of its package price. With your consent, we back up unused WordPress installations and switch them off at no extra cost. Other software is quoted individually, before we start.

You pay extra only for express, additional infected sites on the same account or work outside the scope — and only if you accept it in advance. We add nothing else.

We reply within 4 business hours, Mon–Fri 8:00–18:00 Polish time (CET/CEST), excluding Polish public holidays. Messages sent outside these hours — in the evening, at night, over the weekend or on a public holiday — are read at the start of the next business day and answered by 12:00 CET/CEST. We don't work nights, weekends or public holidays and have no on-call service then.

We start by the next business day at the latest after you accept the offer, give us access and we confirm the contract. With express, we start within 4 business hours if our calendar allows — we confirm this in the offer. If you're buying privately and want us to start before the 14-day withdrawal period ends, say so in the email accepting the offer and confirm that you acknowledge what this means for your right of withdrawal. Without that request, we start only after the 14 days have passed.

An update within the same PHP version is usually quick; a move to a newer version or a cleanup after a hack takes longer. We give you the expected time in the offer.

In our reply to your inquiry, we explain a secure way, step by step. Usually you create a separate account for us in your hosting panel or add our SSH key — and, if your site runs on WordPress, a temporary administrator account. You can also use a one-time, expiring link.

Before we log in or run an active scan, we ask for written authorization and confirmation that the site is yours or that you act on the owner's behalf. Until then, we check only what is publicly visible — without logging in and without active scanning.

As part of the service, we change the passwords and keys on the site. When we're done, we'll also ask you to change your hosting and email passwords and to remove our access.

The vulnerability affects all PHP software. We can update PHP within the same version and check for signs of a break-in on any site — Joomla, Drupal, PrestaShop, Magento, Laravel or custom code too. Whether and how to move to a newer PHP version depends on the software, so we assess it in the diagnosis.

Cleaning up hacked sites that don't run on WordPress is quoted individually. Write to us — we'll tell you honestly whether we can help and, if so, give you a fixed price and the terms before we start. Not sure what your site runs on? We'll find out in the free diagnosis.

Yes. The contract is concluded at a distance, by email, so as a consumer you have 14 days from its conclusion to withdraw without giving a reason. An email is enough; we attach a model withdrawal form to the offer.

A critical vulnerability usually can't wait two weeks. If you want us to start sooner, you say so in the email accepting the offer and confirm that you acknowledge two things: once the service has been fully performed, the right of withdrawal expires; and if you withdraw during the work, you pay for the part completed up to your withdrawal — according to the stages and amounts set out in the offer. For a WordPress cleanup, you then pay only for the stages completed — (1) backup and analysis, (2) cleanup and closing the hole, (3) hardening, report and the review request to Google; each is one third of the offer price. Without that request, we start only after the 14 days have passed.

This request has nothing to do with the paid express option — it applies to every order placed by a consumer.

Under Polish law, if the contract isn't professional in nature for you — say, you run a bakery, not an IT company — you have the right of withdrawal and protection against unfair contract terms on the same basis as a consumer. The right of withdrawal then works just as it does for private customers, including the request for an earlier start.

You may tell us whether the contract is professional in nature for you, but you don't have to — it doesn't affect whether we take on the job. We'll issue the invoice to your business, via KSeF.

You pay once the service is complete, with no deposit, by bank transfer only, to the account of INCREASE Sp. z o.o. — with the offer number in the payment reference.

Businesses get a VAT invoice via KSeF on the day we deliver the report, payable within 14 days. Private customers pay within 7 days of receiving the report; we issue an invoice if you ask for one within 3 months from the end of the month in which we performed the service or received payment. Business customers from other EU countries with a valid VAT ID are invoiced net (reverse charge).

If the attackers could have reached personal data — e.g. customer accounts, orders or form messages — the data controller, which means you, assesses whether the breach must be reported to the President of UODO, the Polish data protection authority, and whether to inform the people whose data is affected. A report to UODO is due without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Your data protection officer (DPO) or a lawyer can advise you on this. Keep in mind that this vulnerability also lets attackers read fragments of server memory, which may hold passwords.

If your company is an essential or important entity under the Polish National Cybersecurity System Act (KSC, which implements NIS2), reporting a significant incident to the competent CSIRT is a legal duty. We don't assess whether your company falls under the Act — check this with your lawyer. Otherwise, you can report the incident voluntarily to CERT Polska at incydent.cert.pl.

We help with the technical part: we promptly send you written information with dates and times — what we've established, what data may have been exposed and what we did. We don't provide legal advice or file notifications on your behalf.

Yes. During the work we may have access to personal data on your site and server — user accounts, orders, form messages. We process it only on your behalf, under a data processing agreement (Art. 28 GDPR). We attach one to every offer, for private customers too, and sign it before we get access — on our template or yours.

We sign an NDA on request. We keep the backup of your site made before the work for 30 days, then delete it permanently.