Hi, I'm Terris. I've built and fixed websites in Singapore full-time for 8 years, and I do every check and fix myself.
CSA alert, 21 Oct 2026: critical PHP flaws, patch immediately
Get your website's PHP updated and safe from PHP2Shell
Singapore's Cyber Security Agency has told businesses to patch PHP now, and most business websites run on it, every WordPress site included. Send me your web address and I'll check for free whether yours needs the update. If it does, I'll update it and fix anything that breaks.
“Terris was outstanding in providing technical support to get my website up and running. He was very patient with several change, always prompt to reply, very thorough and proactive in giving advice to optimize the site.”
- Free check, no obligation
- 8 years full-time, 290+ projects
- Backed up before I change anything
- WordPress, WooCommerce and custom PHP
Check if my site needs the update
Free. I check it myself, with 8 years and 290+ projects behind me.
Rather talk now? WhatsApp me
Rather do it yourself?
The news, in plain English
What the CSA alert means for your website
PHP is the software most business websites run on. Here's what changed this week, and why a site nobody has updated in a while is the one most at risk.
Two flaws, one name: PHP2Shell
PHP released fixes on 21 October for two flaws that let an attacker run their own code on a web server without logging in. CSA's advice to every business is to patch immediately.
Updating WordPress doesn't fix it
The hole is in PHP, the software your server runs the site on. A WordPress or plugin update leaves it open. The PHP version on your hosting has to change.
Old versions get no fix
PHP only released fixes for version 8.2 and newer. If your site is on 8.1, 8.0 or 7.4, PHP isn't patching it. Some hosts patch old versions themselves and many don't, which is what the check finds out.
Which PHP versions got the fix
- 8.5 Fixed in 8.5.12
- 8.4 Fixed in 8.4.27
- 8.3 Fixed in 8.3.36
- 8.2 Fixed in 8.2.35, but support ends 31 Dec 2026
- PHP stopped updating these 8.1 No official fix
- 8.0 No official fix
- 7.4 and older No official fix
I move sites to PHP 8.3 or 8.4, which PHP keeps patching until the end of 2027 and 2028.
Sources: CSA alert AL-2026-151, 21 Oct 2026, and PHP's security release of the same day. CSA chief executive Gwenda Fong: “The threat is immediate.” Qualys figure from its PHP2Shell analysis, 22 Oct 2026. Checked against CSA's alert on 23 Oct 2026.
Signs your site needs the update
- It's on WordPress and nobody has touched the hosting in a year or two
- Whoever built it has moved on, or stopped replying
- WordPress warns you that your PHP version is out of date
- Your host emailed about PHP and you weren't sure what to do
- You don't know who hosts the site, or where the login is
- Send me the address, and anything you know about the site
- I check it myself and tell you what I find
- If it needs the update, you get a fixed price before I start
Is your site affected? I'll check it free
Free. I check it myself, with 8 years and 290+ projects behind me.
What I do if your site needs the update
In 8 years of building and looking after websites, I've found the PHP switch itself takes minutes. The time goes on the old plugin or theme that stops working on the new version, so that's what these steps are built around.
-
I check it, free
From your web address I look at which PHP version the site runs, what it's built on and how old its theme and plugins are. You get the answer by email or WhatsApp, with a fixed price if it needs work.
-
I back it up
I take a full copy of the files and the database before anything changes, so the site can always go back to how it was.
-
I update PHP and fix what breaks
I move the site to PHP 8.3 or 8.4, update WordPress, the theme and the plugins to versions that run on it, and replace any plugin that has been abandoned. Then I test the pages, the forms and the checkout.
-
I look for signs of a break-in
Attacks were recorded before the fix came out, so I check for admin users nobody added, files changed in the last few weeks and code that shouldn't be there, and tell you what I find.
Rather do it yourself? Get the free step-by-step guide
Seven plain-English steps to check your PHP version, back up, update and test your site, with where to click at each one and messages to copy and paste to your host. No coding.
A PDF, emailed to you straight away.
What clients wrote on Google
All 25 of my Google reviews are five stars. Here are a few, in their own words.
“Over the past few years, our company had engaged a few different companies to help us with SEO and website optimisation. Unfortunately, most of the time, we only realised after 1 to 2 years that they were not really doing the work properly. … Terris is very different. He is very proactive, sincere, and serious about his work.”
Jerry Zhang Google review, Jun 2026 “Terris was extremely professional and fast to respond and understand the task assigned, he finished it in a few hours and I am extremely satisfied with the experience. I will use his services regularly to design and update my website.”
Aradhya Kaul Google review, Aug 2024 “Super fast response and solve our website issue in a short time too!”
Mei Ting Tan Google review, Feb 2020 “He listened to what I was trying to achieve and suggested ways to improve it further. Very experienced and honest guy, he knows what he’s doing. Will continue to seek him for further improvements to my website.”
Karyn Keng Google review, Sept 2026 “This guy built my website from scratch, and till today, everything still runs flawlessly. No fluff, no unnecessary talk just straight to the point and gets things done.”
ken low Google review, Mar 2026 “His skill level and attention to detail gave me a lot of confidence in the project. … Trust is difficult to earn, especially after a bad experience, but he proved himself to be dependable, genuine, and someone you can confidently work with.”
Alvin Valencia Google review, May 2026 “He also proactively suggested ideas to improve the website further. Also, he is fast to respond and troubleshoot 💯 highly highly recommended!”
JE Google review, Apr 2026 “Always a pleasure to work with Terris. He works fast and always understands what I need from him. I would def recommend hiring him!”
Dennis Polderman Google review, Feb 2022 “Great response time and efficient Thank you terris!”
William Cheuk Google review, Oct 2024 The person who checks your site is the one who fixes it
I'm Terris. I've worked full-time as a web designer and developer in Singapore for 8 years, on more than 290 projects. I build WordPress and custom PHP sites and look after them afterwards, so updating PHP, and fixing the plugins and themes that break on a new version, is part of my routine.
At an agency, a job like this passes from an account manager to a developer. With me, you message the person doing the work, on WhatsApp, and get a straight answer.
- Years full-time
- 8
- Years full-time
- Projects since 2018
- 290+
- Projects since 2018
- Google rating
Once it's fixed, keep it that way
If nobody has been looking after your website, the PHP update is usually the first of a few jobs it needs. You can stop at the fix, or pick one of these. I'll recommend one after the check, and there's no pressure either way.
Just the fix
From SGD 850 one-offThe PHP update and anything it breaks, at a fixed price agreed before I start. Nothing after that unless you ask.
Keep it looked after
SGD 550 a monthUpdates, daily backups and security, plus 5 hours of changes on any site. Month to month, so you can stop whenever you like.
Rebuild it
From SGD 2,535 one-offIf the site is too old to upgrade cleanly, I'll say so and quote a new one next to the fix, so you can compare. A Starter site takes 2 to 3 weeks.
Questions people are asking about the PHP update
Do I need to update PHP?
If your website runs on PHP, almost certainly. Every WordPress and WooCommerce site does, and so do Joomla, Drupal and most sites a developer built from scratch. Sites on Wix, Squarespace and Shopify don't: the platform handles it. If you're not sure which you have, send me the address and I'll tell you.
How do I check which PHP version my website uses?
In WordPress, go to Tools, then Site Health, then the Info tab, and open Server. In your hosting control panel, look for Select PHP Version or MultiPHP Manager. Or send me your web address and I'll check it for you, free.
Can I update PHP myself?
Yes, if you can log in to your hosting account. You check your version, back up the site, update WordPress and the plugins, switch PHP to 8.3 or 8.4 in the hosting panel, then test everything. My free guide on this page walks you through each step in plain English, with where to click. If the site breaks, switch back to the old version and message me.
Isn't updating WordPress enough?
No. The flaws are in PHP itself, which runs underneath WordPress, so a WordPress or plugin update leaves the site exposed. The PHP version on your hosting has to be updated, and then the web server restarted so the fixed version is the one running.
Will the update break my website?
It can. Themes and plugins written for PHP 7 often throw errors on PHP 8, which is why sites get left on old versions. That's the part I handle: I back the site up first, update or replace what doesn't run on the new version, and test it before I hand it back.
What if my site has already been hacked?
Then updating PHP isn't enough on its own, because anything an attacker left behind stays. Tell me in the form if something looks wrong, like pages you didn't make or an admin you don't recognise. I look for the usual signs as part of the job and tell you what I find before going further.
I don't have the hosting login. Can you still help?
Usually, yes. If you know who you pay for hosting, the account owner can reset the password. If nobody knows who the host is, I can usually find out from the domain's records, and we go from there.
How much does it cost?
The check is free. If your site needs the update, you get a fixed price in writing before I start, and one-off jobs like this start from SGD 850. If the site is old enough that a rebuild makes more sense, I'll quote both so you can compare.
Who will I be dealing with?
Me. I'm Terris, a web designer and developer in Singapore. I've done this full-time for 8 years, since 2018, on more than 290 projects, and I build and look after WordPress and custom PHP sites. I do the check and the work myself, and you can message me directly on WhatsApp.
Send me your web address and I'll check it for free
You don't need to know anything technical. I'll tell you which PHP version your site runs, whether it needs the update, and what that would cost.
Or WhatsApp meRather do it yourself?
Check if my site needs the update
Free. I check it myself, with 8 years and 290+ projects behind me.