PHP vulnerability fix
Your PHP server or VM, patched against php2shell.
On 21 October 2026 PHP shipped emergency fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, that let anyone on the internet run code on a server or VM running PHP - no login needed. If your site runs on PHP and nobody has updated it since, it is exposed.
What is affected
Every PHP version from 5.4 up to 8.5.11, however it is served - PHP-FPM, Apache mod_php, php-cgi, LiteSpeed or FrankenPHP. Apache with mod_php is the worst case, because the attack lands before your own code even runs.
What fixes it
PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor build with the fix backported. PHP's security team also released backports for 7.4, 8.0 and 8.1, which are otherwise out of support.
Who is doing it
20 years of PHP, and of keeping PHP servers running.
I have been building in PHP for twenty years and doing the devops around it for just as long: the web servers, the PHP builds, the deploys, and the 2am "why is it down". Patching a server or VM is not new work for me. Doing it fast, without breaking the sites on it, is the part that takes experience.
The fix
$200
A flat fee per server or VM. I update PHP to a patched release, or install your vendor's patched build, and confirm the version that is actually serving requests is the fixed one.
Checking the sites
$200/hr
Making sure every site on the server or VM still comes up and works after the update is billed by the hour, because it depends on how many sites there are and how much each one does.
Legacy code
Let's talk
If a site was written for an old PHP and breaks on a patched one, we can talk about updating the code so it runs on the new patches. That is quoted once I have seen it, not guessed at.
Host too slow?
I can move you somewhere that is already patched.
If your host has not rolled out the fix fast enough, I can migrate your site to a patched server or VM and get you back up live - as long as it can run on one of the patched PHP releases. If it cannot yet, the legacy-code conversation comes first.
What to send me
- Where the server or VM is hosted, and what kind of access you have
- The PHP version it runs today, if you know it (php -v)
- Roughly how many sites are on it
- Whether the host has said anything about the fix
Don't put passwords in the form. I will ask for access in a way that can be revoked once the work is done.
Next step
Tell me about your server or VM.
Pick "PHP vulnerability request" on the form - it is already chosen if you use this button. I read these myself and reply as fast as I can while this is going on.
Sources: PHP's 21 October 2026 security release, and the advisories from CISA and the UK NCSC.