THE ISSUE

What Happened, And What It Means For You

Most business owners have no way of knowing which version of PHP their site runs on. That is the whole problem, and it is the part we can answer for you.

In Brief

  • On 21 October 2026 the PHP project released emergency fixes for two critical flaws, nicknamed "PHP2Shell".
  • They let an attacker run their own code on a website's server, and attacks began before the fixes were out.
  • PHP runs around 70% of all websites, including every WordPress, WooCommerce, Drupal, Joomla and Magento site.
  • Sites on PHP 8.1 or older, roughly half of all PHP sites, have no official fix at all.

On A Supported Version (8.2 to 8.5)

The security update needs installing and the server restarting. Some hosts have done this automatically. Many have not, and will not unless someone asks.

On PHP 8.1 Or Older

There is no official fix for these versions. The site has to be moved to a supported version of PHP, and tested afterwards, to close the gap.

THE PROCESS

How The Free Check Works

Four simple steps, and you only have to do the first one.

1

Tell Us Your Website

Use the form below, reply to our email, or message us on WhatsApp. That is all we need.

2

We Check From Outside

We read only what your site already shows every visitor. No passwords, no logins, nothing installed or changed.

3

You Get A Plain Answer

Within one to two working days: looks fine, needs attention, or could not be confirmed, and what that means for you.

4

You Decide

If it is clear, you receive our security reviewed badge. If it needs work, you get a fixed price to consider. No obligation.

GET STARTED

Request Your Free Check

This opens a ready made email to security@msyncltd.digital in your mail app. If it does not open, just email us your website address.

The Check Reads Only What Is Public

We look at the information your website already hands to every visitor, such as the server's own headers and the platform signals on the page. That tells us a great deal about what your site runs on, without going anywhere near the inside of it.

We never test, probe or change anything without your written go ahead, and we never ask for passwords or hosting access. If you would like all of this in writing before you decide anything, just ask.

0333 335 7615   07874 482761

AFTER THE CHECK

The Security Reviewed Badge

Once your site has been checked and is clear, we send you a badge you can add to your own website, with step by step instructions so you can do it yourself in a few minutes.

What it means: that M.Sync carried out an external security review of the website on the date shown. A simple, honest way of showing visitors you take their security seriously.

What it does not mean: it is not a promise that a website can never have a problem, and we would never word it that way. If a site needs work first, the badge is sent once that work is done, so it is always true.

Website Security Reviewedby M.Sync · October 2026

How the badge looks on a site. It links back to this page so visitors can see exactly what was checked.

IF WORK IS NEEDED

Only If The Check Says So

And only with a price agreed with you first. Nothing open ended, no surprises.

PHP Update & Verification

Fixed fee

We move your site to a supported version of PHP, test everything still works, and confirm the running version to you in writing.

Ongoing Security Plans

From £59.99/mo

For businesses that would rather not think about it again. Monitoring, updates and maintenance looked after month to month.

Rebuild With No PHP

Quoted individually

For older brochure sites, a clean custom coded rebuild with no PHP to patch, so there is nothing left to worry about next time.

Already Have A Developer?

Still free

Forward them the result. The check works just as well as a second pair of eyes for whoever already looks after your site.

COMMON QUESTIONS

Questions People Ask Us

Is my website actually affected?

That is exactly what the check answers. If your site runs on a supported, updated version of PHP it is likely fine, and we will tell you so. If it is on an older version there is no official fix and it needs moving to a supported one. We would rather look properly than guess.

Do you need my passwords or access to my site?

No. The check reads only the information your website already shows to every visitor. We never ask for passwords, hosting logins or admin access, and nothing is installed or changed.

I already have someone who looks after my website.

That is great. The check is still worth having, because you can forward the result straight to them and they can act on it. It is a second pair of eyes, not a replacement.

How much does it cost?

The check is free. If your site needs updating, we agree a fixed price with you before any work starts, so there are no surprises. Ongoing plans from £59.99 a month are available if you want them, and entirely optional.

How do I know M.Sync is legitimate?

M Sync Ltd is a UK registered company, number 17288590, based at 5th Floor, 167-169 Great Portland Street, London, W1W 5BW. The check only reads public information, we never ask for access, and we are happy to put everything in writing before you decide anything.

You emailed me. How did you get my address?

We only ever use the business email a company has chosen to publish on its own website. If you would rather not hear from us again, reply "unsubscribe" to that email and we will not contact you again.