Hosting for Old PHP Sites, Protected Against PHP2Shell

Your old PHP site can keep running

PHP2Shell is the nickname for two critical flaws in the PHP interpreter, the software that runs WordPress, Drupal, Joomla, most online shops and a huge number of bespoke business systems. The details leaked on 20 October 2026, and the PHP security team rates both flaws Critical, with a CVSS v4.0 score of 9.2. According to Wiz Research, a single web request with no login can lead to an attacker running their own code on the server.

The official fixes only cover PHP 8.2 to 8.5. PHP 8.1 and older are end of life, so many hosts will tell you to upgrade or leave. We won't. Older sites that other hosts refuse are what we have always taken on, and that has not changed. We still run PHP 5.6, 7.0 to 7.4, 8.0 and 8.1, and here is how we keep them protected.

How we protect old PHP after PHP2Shell

Old PHP gets several layers, so no single one has to be perfect:

• Cloudflare's firewall in front. We have used Cloudflare in front of hosted sites for over a decade, so proxied sites were behind Cloudflare's emergency PHP2Shell rules from 03:02 UTC on 21 October. We are checking every hosted site is actually proxied, not reachable directly at the server.
• A security extension that closes the known attack path. Hosted Power's open-source php_uploadprogress_guard closes the multipart upload route used by both flaws on unpatched PHP 5.6 to 8.5.
• Hardened PHP settings at server level, in line with the PHP team's temporary mitigations.
• Each site isolated under its own system user and PHP-FPM pool, so a problem on one site cannot reach another.
• Monitoring for signs of attack, and checks of sites for signs of tampering.

Where a vendor-patched build of an older PHP version is available, we use it. Sites on PHP 8.2 to 8.5 get the official fixed releases. This work is in progress across our servers. If you host with us and want to know where your site is up to, ring 01623 650333.

The honest bit: mitigations, not an official fix

For end-of-life PHP there is no official fixed release, so these layers are mitigations rather than a fix. Hosted Power's own documentation says a patched PHP release is the only complete mitigation, and the extension does not cover every case, such as out-of-memory errors inside the application itself. Cloudflare's CTO called its emergency rules "a stopgap only".

That is why the protection is layered: the firewall filters the attack at the edge, the extension closes the known route at the server, isolation limits what any single site can reach, and monitoring watches for anything that gets through. Upgrading to a supported PHP version is still the long-term best option, and when you want to do it we will quote for any code changes. It is your choice and your timetable, not a condition of hosting.

Why Cloudflare on its own is not enough

Cloudflare deployed its emergency rules about nine hours before public disclosure, on every plan with its web application firewall, including the free plan. That bought real time, but the rules only apply to traffic that passes through Cloudflare's proxy (the orange cloud). A site whose DNS is on Cloudflare but not proxied, or whose server can be reached directly at its IP address, is not shielded. Cloudflare also tells customers to patch PHP even with the rules in place. On old PHP, that is where the extension, hardened settings and isolation come in.

Moving your old site to dijihost

If your host is switching off your PHP version, or cannot tell you what it is doing about PHP2Shell, you can move to us. dijihost Complete Hosting is £1 a day + VAT (£365 a year + VAT, or £35 a month + VAT) and includes:

• free migration, keeping the PHP version your site needs, tested on a temporary address before DNS changes
• the protection layers above, with Cloudflare set up and managed by us
• a check for signs of tampering before the site moves, because a compromised site gets cleaned before it moves, not after
• daily backups kept for 14 days, free SSL and one domain registration or renewal a year

See legacy PHP hosting and PHP 5 hosting for more on older sites, or read PHP2Shell: what UK website owners need to do. Order Complete Hosting, or call 01623 650333 and tell us what your site runs on.

Related