Prepare. Preserve.
Recover with evidence.

Routine patching or incident response?

Routine patching is appropriate when an authorised administrator is applying a verified update and there is no current indication of compromise. Suspicious administrator accounts, web shells, unexplained changes, stolen credentials, unexpected outbound traffic or confirmed unauthorised access require incident triage. Assess the whole exposure window; a clean-looking website is not evidence of a clean server.

Preserve the record

• Record time with time zone, observer, source system and what was actually seen. Separate observations from hypotheses.
• Protect original logs, relevant snapshots and authorised evidence copies. Record who collected each item and how it was handled.
• Avoid cleanup or restoration steps that destroy evidence before the responder has advised. Balance evidence preservation against urgent containment needs.
• Use a separate trusted device and communication route if current accounts or systems may be compromised. Do not put passwords or personal data into public issues.

Verify before returning to service

• Confirm a trusted recovery source and determine how the intrusion happened.
• Patch PHP and the relevant application, replace affected workers and remove unauthorised persistence through an approved rebuild or recovery process.
• Rotate exposed credentials from a trusted device after containment, and review access across related systems.
• Validate data integrity, key functions and logging before a controlled return to service. Keep a named owner for monitoring and unresolved risks.

Business continuity

Identify essential work that can continue without the website. Agree a named incident lead, trusted staff contact route and a simple approved status message. Pause automated workflows that could create duplicates or disclose data. Keep a manual queue for customer requests and reconcile it after recovery. Avoid collecting extra personal data just because the normal system is unavailable.