Your PHP is open. We close it today.
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets anyone run code on your server with a single request, no username or password. The exploit is already public. We update your PHP, check whether someone got in first and hand you the report.
- Severity
- CVSS 9.2 critical
- Access required
- None
- Official patch
- 21 Oct 2026
- Safe versions
- 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35
What is PHP2Shell?
Two critical flaws in PHP's core (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) that allow unauthenticated remote code execution before your application even runs. They affect PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP fixed them on 21 October 2026 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Source: php.net security announcement, 21 October 2026.
Updating is half the job. The other half is knowing if they're already in.
The technical details leaked hours before the patch and working exploits are already published. An attacker doesn't need your password or a vulnerable plugin: one request is enough.
If someone got in before you updated, the patch shuts the door but leaves behind whatever they installed: a webshell, a new admin user, a cron job that comes back every hour. That's why we don't sell a bare update.
758K servers on the internet advertise unsupported PHP branches (5.4 to 8.1). There is no official patch for them. (VirusTotal, 21 Oct 2026)
Three ways to keep it shut.
Start with the one you need today. We quote on your servers and your stack, not a generic rate.
Emergency patch: Under 24 h
Your PHP updated to the fixed release, without taking the site down.
- Inventory of servers, PHP-FPM pools and versions
- Immediate php.ini mitigation while we update
- Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35
- Site tests before and after
- Rollback plan if anything fails
Patch + compromise audit: 24 to 72 h
Everything in the patch, plus the answer to the question that matters: are they already in?
- Everything in the emergency patch
- Search for webshells and modified files
- Log review back to the leak
- New users, cron jobs and SSH keys
- Credential rotation where needed
- Signed report for your team or your client
Unsupported version migration: Depends on codebase size
For PHP 5.x, 7.x, 8.0 and 8.1, which won't get this patch.
- Same-day mitigation while we migrate
- Compatibility analysis of your code and plugins
- Migration to PHP 8.4 or 8.5 in staging
- Fixes for whatever breaks
- Production release with monitoring
How we work from the moment you write.
- Free diagnosis. We check your domain from the outside and tell you which version you expose and how urgent it is.
- Mitigation. Before touching versions, we apply the php.ini settings that close the known vector.
- Update. We update with tests before and after and a rollback plan ready.
- Audit and report. We look for signs of intrusion and hand you what we found, what we changed and what comes next.
If you can't update in the next hour, do this.
This is the interim mitigation PHP published. It doesn't replace the update and may not cover every vector, but it cuts your exposure today. After changing it, reload PHP-FPM, Apache or LiteSpeed.
session.upload_progress.enabled = 0
post_max_size = 8M ; or the smallest your site needs
; PHP 8.5 only
fatal_error_backtraces = 0What people are asking us.
How much does it cost to update PHP and audit my server?
It depends on three things: how many servers you have, whether your version still gets patches and whether you want the compromise audit. A patch on a supported branch is a matter of hours; a migration from PHP 7.x depends on the size of your code. The diagnosis is free and you get a fixed quote before we touch anything.
I'm on shared hosting. Won't they update it?
Many will, but not all at the same pace, and some let you pick old versions for compatibility. If your panel lets you choose PHP 7.4 or 8.1, your site can stay exposed even when the server has a newer branch available. We check it and, if needed, handle the change with your host.
I run WordPress, Laravel or Magento. Am I affected?
Yes. The flaw is in PHP, not your application, and it fires before your code runs. Keeping WordPress or Laravel up to date does not protect you from this one.
I have Cloudflare. Am I already protected?
Cloudflare shipped WAF rules for the known vectors, even on the free plan. They help, but only if your origin server isn't directly reachable, and they don't replace the patch. We check both.
My site runs on PHP 7.4. What do I do?
PHP 7.4 no longer gets official updates. Today we apply the mitigation and check whether your vendor offers a backport. In parallel we plan the move to 8.4 or 8.5, the only exit you won't have to repeat at the next flaw.
Can you work without root access?
The full audit needs server access. If all you have is a hosting panel, we do what the panel allows and tell you exactly what stayed out of reach.
Get your free diagnosis.
Send us your domain. We'll tell you which version you expose, how urgent it is and what it costs to close.