For founders with a prototype
Take your prototype to productionFor teams that need engineers
An engineer in your team while you hireAn extended dev team, month to monthFor founders with a prototype
Take your prototype to productionFor teams that need engineers
An engineer in your team while you hireAn extended dev team, month to monthCVE-2026-109618 and CVE-2026-109619
You send a request. We check the PHP your site actually runs, then patch, upgrade or backport it until it includes the PHP2Shell fixes (CVE-2026-109618 and CVE-2026-109619). We also look for signs that someone already got in. You get a written report covering what we found, what we changed, and the final status: checked and patched.
We've checked and patched PHP hosts we run for clients (WordPress, WooCommerce and Moodle sites).
Not sure you're affected? Start with Am I affected by PHP2Shell?
We check the PHP version and Server API (SAPI) your site actually uses, not just the number in the panel. Where the hosting panel (for example MultiPHP Manager or Select PHP Version) allows it, we switch the site to a patched version. Where it doesn't, the server's PHP belongs to your host, and we send your host the exact request.
We check every PHP that serves the web (PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed), check the distro packages against the distro's security tracker, and update to a fixed release: 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (php.net), or a patched distro package. Then we restart every worker so no old process keeps running.
The PHP project no longer ships updates for 8.1 and older. The PHP security team published source backports for 7.4, 8.0 and 8.1 (php.net). If your app can't move to a newer branch yet, we apply the fix through those backports.
A patch closes the hole. It doesn't remove anything that got in before. We look for PHP or web server processes spawning shells, new files or webshells in the web root, and new cron jobs or accounts.
It covers the version and SAPI we found, what we changed, the compromise-check results, and the final status.
Anything not in the list above. For example:
If the compromise check finds signs of trouble, we put them in the report and discuss next steps separately.
You send a request. Tell us the hosting type (shared hosting or VPS) and the domains to check.
Written report the same day you request it: PHP version, SAPI, package status, and what needs patching.
Patch applied within one working day after that: update, upgrade or backport, then restart every worker.
Re-check and compromise check. We re-check the version the web server runs and update the same report with the results and the final status: checked and patched.
Book a call on Calendly or email [email protected] with the subject "PHP2Shell Check & Patch". Include your hosting type and domains.