Paid services are in preparation. Online payment and server jobs are not open yet. Check a PHP version free or email [email protected] about your setup. Prices below describe the planned services.
PHP2Shell patching for your PHP servers
Get help updating PHP for CVE-2026-109618 and CVE-2026-109619. We inspect the server, apply the appropriate fix and check the PHP processes serving your applications.
Technical sources reviewed
Start with what you know.
If your host manages PHP for you, ask whether it has already patched the web runtime. If you control a server running PHP 8.2 to 8.5, the Patch service covers the supported server update. If you do not know which PHP installations are present, start with a Scan.
- You have a version number
- Use the free version checker. It compares the version you supply; it does not inspect the server.
- You need a server assessment
- Scan starts at $99 per server and checks PHP installations, package patch status, running workers and signs of compromise. Its fee is credited toward a Patch for that server within 14 days.
- Your application needs PHP 8.1 or older
- Check whether your package vendor supplies a backport, a fix adapted to an older release. Otherwise, plan a PHP upgrade. Confirm this setup before buying an ordinary Patch.
Match the fix to your package.
The PHP project released fixes for CVE-2026-109618 and CVE-2026-109619 on October 21, 2026. These flaws can let an unauthenticated web request run code on a server.
| PHP branch | Fixed release |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
A distribution package may carry the fix under an older-looking version. For Ubuntu 24.04, Canonical lists 8.3.6-0ubuntu0.24.04.13. Compare the full package revision with its vendor notice rather than applying the upstream table to every build.
Sources: PHP release announcement, Ubuntu package notice, and the PHP advisories for CVE-2026-109618 and CVE-2026-109619.
Update PHP and check the running server.
Inspect the setup
Identify PHP installations, package sources and the processes serving your applications. Confirm scope, access, the maintenance window and recovery with you.
Review and apply the change
Review the update plan before changing the server. Apply the appropriate fixed build and restart the affected PHP services. Keep a record of configuration changes.
Check PHP and your application
Check the installed package and running workers, then run the agreed application checks. Record unavailable or unresolved checks so you know what still needs attention.
Review findings and hand over
Provide the written report and change record, including a read-only sweep for signs of compromise. Any suspicious finding needs a separate investigation decision. A clean sweep cannot establish that a server was never compromised.
Configuration backups and a rollback script help undo recorded file edits. Restoring an older package or a complete server needs a separate recovery method, such as a usable host snapshot. We agree that before patching.
Choose a standard or priority start.
Patch is $249 per server for one to four servers. A server is one machine, virtual machine or container host running PHP, regardless of how many websites it serves. Larger groups use the fleet price table.
Paid delivery is not open yet. Standard and Priority start options need confirmed scheduling and supported-platform coverage before they can be offered. The planned Priority add-on is $250 per server; no start deadline is available now.
If a fixed build is unavailable, Emergency stopgap costs $149 per server and is credited toward an upgrade. It reduces exposure while a permanent change is arranged. Review your platform with us if it falls outside the supported Patch scope.
Prices are in US dollars. Review the total shown at checkout. Review scope and the guarantee in Terms. Extra engineering is quoted first at $150 per hour in 30-minute blocks.
Common PHP2Shell decisions
I updated PHP. Why check again?
A package on disk and a running web worker can differ. The service checks which PHP serves requests and whether old workers remain, along with the agreed application checks.
Can a firewall rule replace the patch?
PHP says temporary controls reduce specific attack paths but do not make an unpatched installation safe. Use a fixed build or a supported upgrade for permanent remediation.
Can you patch several client servers?
Yes. Fleet support starts with a server list and a review of the environments, access and rollout schedule.
Should I send a password?
Do not put passwords or private keys in the booking form or email. We arrange appropriate access after booking.