PHP2Shell/ CVE-2026-109618 + CVE-2026-109619/ CVSS 9.2/ Fixed releases out Oct 21/ Oct 21 release Check your version
Fix my server
Fixed-price incident response for PHP2Shell

Your PHP servers, patched against PHP2Shell. Today.

Two critical flaws in PHP let anyone take over an unpatched web server without logging in. We find every PHP runtime on your servers, apply the right fix for your platform, restart every worker, and prove it's live. Then we check whether anyone got in first.

Fix my server for $249 → Check my version free
  • Fixed price per server
  • No fix, no fee
  • Written proof of the fix
01 / The problem

Two bugs in PHP itself. Not your plugins. Not your code.

If a server runs PHP to serve web pages, assume it is affected until it's proven otherwise.

On October 21, 2026, PHP shipped fixes for CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. Both let an attacker run their own code on your server with nothing more than a crafted web request. No password, no account, no vulnerable plugin required.

The flaws sit in how PHP handles requests, so it doesn't matter whether you run WordPress, Laravel, Magento or code you wrote yourself. PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed are all in scope. mod_php is the highest risk, because the attack lands before your application code even runs.

Patching is harder than it sounds. Distributions ship the fix under old version numbers, release candidates look patched but aren't, and PHP workers that never restarted keep running the vulnerable code. Some security teams also report exploitation attempts from before the bugs were public, so "patched now" doesn't answer "were we hit last week?"

9.2/ 10

CVSS v4 severity, for each of the two flaws.

0

Logins, accounts or plugins an attacker needs.

≤8.1

End-of-life PHP has no routine fix. CISA says take it offline until it's fixed.

02 / What we do on your server

Not just "update PHP." The whole job, with evidence at every step.

Our remediation engine runs the same six stages on every server, whether it's one VPS, a fleet over SSH, or containers in Kubernetes.

  1. 01Find

    Every PHP runtime on the box

    CLI, PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed, cPanel, Plesk, CloudLinux and Remi builds, Docker containers and Kubernetes pods. Each one linked to its package, its running processes and its real configuration.

  2. 02Decide

    A verdict with evidence

    Package-aware, not a version guess. It knows Ubuntu 24.04's fixed build still says 8.3.6 and that 8.5.12RC1 isn't fixed. Workers still running a deleted binary count as vulnerable.

  3. 03Plan

    The exact fix for your platform

    apt, dnf module streams, apk, cPanel, Plesk, DirectAdmin, Docker tag bumps or a source build. Plus the right restart: Apache with mod_php needs a full restart, because a reload keeps the old PHP loaded.

  4. 04Apply

    Backed up and reversible

    Backups before any change, every change journaled, and a rollback script left on your server. Config tests run before anything restarts.

  5. 05Prove

    The fix is live, not just installed

    Version on disk, version in the running workers, no workers mapping a deleted binary, config tests passing. If an edge rule was added, we test that it fires.

  6. 06Sweep

    Did anyone get in first?

    A read-only compromise sweep of the days before you patched: worker process trees, recently changed PHP files, cron, users and keys, persistence, logs and outbound connections. Nothing is deleted.

What a report will never claim

We'd rather be accurate than reassuring.

  • We never exploit your server to test it. Proof comes from the running system, not from attacking it.
  • Config and firewall mitigations reduce exposure but aren't a fix. Every report says so when they're all you have.
  • A clean compromise sweep is strong evidence, not proof. If we find something, we tell you to preserve it, not delete it.
03 / Who we work with

One server or five hundred. Same process, same proof.

Business and site owners

You have a site and a host. You don't have time for this.

Tell us where you're hosted. We do the update, check nothing broke, and explain what changed in plain English.

  • VPS, cloud and dedicated servers
  • cPanel, Plesk and DirectAdmin servers
  • Managed hosting: we check whether you've been patched
Patch one server for $249 →
Agencies, hosts and MSPs

Dozens of client servers. One deadline.

Send us a host list. Servers are worked in parallel, internet-facing first, and you get one combined report across all of them.

  • Per-server price drops from 5 servers
  • One report for the whole fleet, plus one per server
  • One order, one invoice
See fleet pricing →
Engineering teams

You know how to do it. You don't have the hours.

We work inside your change process: tickets, staging first, maintenance windows, and a reviewable script before anything runs.

  • Staging before production
  • Dockerfiles and image tags bumped to fixed releases
  • SSH, Docker and Kubernetes fleets in parallel
Talk to an engineer →
04 / How it works

Two minutes to book. A fixed start time. Proof when it's done.

  1. Book

    2 minutes

    Pick a plan and tell us your PHP version and hosting. We reply with a confirmed price and start time.

  2. Grant access

    10 minutes

    Add the temporary SSH key we send you, or a limited control-panel user. We never ask for passwords by email.

  3. Fix

    Next business day, or 4 hours with priority

    We run the six stages above. If anything breaks, we roll back first and fix second.

  4. Proof

    Same day as the fix

    You get the written report: what we found, what we changed, how we verified it. Then our access is removed.

05 / Pricing

Fixed prices. Per server. No hourly surprises.

Prices in USD. A server is one machine, VM or container host running PHP, however many sites it serves.

Know where you stand

Scan

Every PHP runtime found and judged, plus a compromise sweep.

$99
per server. Credited toward a Patch within 14 days.
  • Every PHP runtime inventoried
  • Package-aware verdict for each
  • Stale-worker and mitigation check
  • Compromise sweep since Oct 15
  • Written report with the exact fix
Book a scan
Supported PHP 8.2 to 8.5

Patch

The full six stages, start to finish, on one server.

$249
per server, one time
  • Everything in Scan
  • Fixed build for your platform
  • Every PHP worker restarted
  • Fix proven live in running workers
  • Rollback script left on the server
  • Starts next business day
Book a patch
Patch included Patch now, stay patched

Care

This patch, plus every PHP security release after it, for a year.

$490
per server, per year. About $41 a month.
  • PHP2Shell Patch included ($249 value)
  • Critical PHP fixes within 24 hours
  • Other PHP security releases within 72 hours
  • Monthly scan and compromise sweep
  • Front of the queue for incidents
Start Care
PHP 8.1 and older

Upgrade

Move end-of-life PHP to a supported version without breaking the site.

$749
per site, from. Custom apps start with a $490 audit, credited in full.
  • Everything in Scan
  • Compatibility check of code and extensions
  • Upgrade tested on staging first
  • Up to 3 hours of code fixes included
  • Cutover with a tested rollback
Book an upgrade

Priority start

+$250

Per server. We start within 4 hours, any day of the week, instead of the next business day.

Emergency stopgap

$149

No fixed build for your platform yet? Admin-level mitigations and edge rules to cut exposure now. Credited toward an upgrade.

Extra engineering

$150/h

Work beyond what a plan includes. Quoted before we start, billed in 30-minute blocks.

Agencies, hosts and MSPs

Five servers or more? The price per server drops.

Same six stages and the same evidence on every server, run in parallel, with one combined report. Send your host list and we'll confirm a schedule within one business day.

Get a fleet quote

ServersScanPatchCare / yr
1 to 4$99$249$490
5 to 24$79$199$390
25 to 99$59$159$290
100 or morefrom $39from $129Custom

Prices are per server. Payment is due before work starts and is covered by the no fix, no fee guarantee. Sales tax is added where it applies.

06 / Proof

Don't take our word for it. Get it in writing.

Every job ends with a report you can forward to a client, a board or an auditor: what we found, what we changed, how we verified it, and when our access was removed. Fleets get one combined report plus one per server.

Verification reportFIXED
Server
web-01 / Ubuntu 24.04 / nginx + PHP-FPM
Runtimes found
php8.3-fpm, php8.3 CLI
Before
8.3.6-0ubuntu0.24.04.12vulnerable
After
8.3.6-0ubuntu0.24.04.13 fixed (USN-8948-1)
Running workers
41 of 41 on the fixed build; no deleted-binary mappings
Config tests
php-fpm8.3 -t passed; nginx -t passed
Mitigation kept
session.upload_progress.enabled = 0 (php.ini)
Compromise sweep
Since 2026-10-15: no critical or high findings
Rollback
rollback.sh and backups kept on the server
Access removed
2026-10-22 16:42 UTC
Sample report. Server details are illustrative.
07 / Access and safety

We need into your server. Here's exactly how we handle that.

Someone else with access to your server is a real risk. These are the rules we work by on every job.

  • A1

    No passwords by email. Ever.

    You add a temporary SSH key we send you, or create a limited user in your control panel. You can revoke it at any moment.

  • A2

    Read-only until you approve.

    Finding, judging and sweeping change nothing. Only the apply stage changes your system, and only after you've seen the plan.

  • A3

    Every change journaled.

    Backups are taken before each change, every change is recorded, and a rollback script stays on your server.

  • A4

    Your data stays where it is.

    We don't copy databases or site files off your server. Backups stay on your server too.

  • A5

    Access removed when we're done.

    We remove our key and record the time in your report. You can check it yourself.

No fix,
no fee.

If we can't get your server onto a fixed PHP build, you pay nothing for it. If you've already paid, you get a full refund. Just reply to your report and tell us.

08 / Questions

What people ask before they book.

Something else? Email help@phpfixes.com.

Is my server actually affected?

If it runs PHP and serves web requests, assume yes until it's on a fixed build with every worker restarted. Upstream that means 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Distribution builds can be fixed under an older number, which is why a Scan checks the package, not just the version. The free version check gives you a first answer in ten seconds.

Were we already hacked?

Some security teams report exploitation attempts from before the bugs were public. Every Scan, Patch and Care job includes a read-only compromise sweep of the period before you patched. If it finds something, we tell you what, preserve the evidence, and recommend which secrets to rotate.

My host manages PHP for me. Do I need you?

Maybe not. Many managed hosts are patching their customers right now. Ask yours which PHP build your site runs and when it was updated. If you're on a VPS, a dedicated server or a control panel where you pick the PHP version, the update is usually yours to do. That's where we come in.

There's no fix for my platform. Now what?

Some platforms have no fixed build, for example Amazon Linux 2023's php8.1, Alpine 3.21 to 3.23, Ubuntu 25.04 and 25.10, and Debian 11 without paid extended support. The real fix there is an upgrade or a migration. Until then, our Emergency stopgap applies admin-level mitigations and edge rules, and we'll tell you plainly that they're partial.

Will updating break my site?

A patch within the same branch, say 8.3.14 to 8.3.36, rarely breaks anything. Jumping branches, like 7.4 to 8.3, often does. That's what the Upgrade plan is for: we test on staging first, fix what breaks, and keep a rollback ready.

How fast can you start?

Standard jobs start the next business day. With Priority start (+$250 per server) we begin within 4 hours, any day of the week. Care customers go to the front of the queue.

Do you work with WordPress, Laravel, Drupal and Magento?

Yes. PHP2Shell is a PHP problem, not an application problem, so we fix it at the server level and then check your application still runs properly.

How does payment work?

You get a confirmed price and start time by email before anything happens. Payment is due before work starts, and the no fix, no fee guarantee covers it.

Are you part of the PHP project?

No. PHPFixes is an independent service. PHP is a trademark of The PHP Group.

Ready when you are

Every day a server stays unpatched is a day someone else can try it.

Book now and we'll confirm your start time. Or check your version first. It's free and takes ten seconds.

Fix my server → Check my version