Your PHP server is open to attack. I'll patch it.
Two critical PHP flaws disclosed on 21 October let attackers run code on your server without logging in. Every PHP version since 5.4 is affected, and attacks have already started.
$ php -v
PHP 8.3.20 (cli)
✗ Vulnerable to CVE-2026-109618, CVE-2026-109619
$ ny8 patch # that's me
$ php -v
PHP 8.3.36 (cli)
✓ Patched
Two prices. Pick yours.
Flat price per server, in USD. Not sure which? Claim either one and I'll check for you.
Minor upgrade
$20
USD, per server
You're on PHP 8.2, 8.3, 8.4 or 8.5.
I update PHP to the patched release in the version you already run. Your code doesn't change.
e.g. 8.3.20 → 8.3.36
Major version upgrade
from$70
USD, per server
You're on PHP 8.1, 8.0, 7.x or older.
These versions get no official fix. I move you to a supported, patched PHP 8 and run a surface check that your site still loads.
e.g. 7.4 → 8.3.36
What happened
Two flaws in PHP itself, nicknamed PHP2Shell. PHP rates both 9.2 out of 10. They're in PHP, not in your code, so every PHP site has them until PHP is updated.
Code execution via out-of-memory corruption
If PHP runs out of memory at the wrong moment, it can clean up half-built request data as if it were valid. An attacker can use that to run their own code.
Code execution via stale state
Leftover data from one request can point at memory that's already been freed. The next request on the same PHP worker can use it, which can leak memory or run an attacker's code.
17 Oct 2026
First attack attempt seen
Amazon's threat intelligence team spots an exploit attempt on its honeypots, four days before the flaws are public.
20 Oct 2026
CVE numbers leak
The CVE IDs circulate online before a fix exists. PHP announces an emergency security release.
21 Oct 2026
PHP ships the fix
Patched releases go out at 14:00 UTC, a day earlier than planned because of the leak.
21 Oct 2026
Attacks start
Amazon, Cloudflare and watchTowr report exploitation attempts. CISA tells everyone to patch immediately.
In the news: CISA · Tenable · Help Net Security · The Hacker News · Qualys
How it affects you
One request is enough. No login, no plugin bug, nothing you did wrong — the attack hits PHP before your site's code even runs.
You're at risk if:
- Your site runs on PHP — WordPress, WooCommerce, Laravel, Magento, Drupal, Joomla or custom PHP
- It runs PHP-FPM, Apache mod_php, php-cgi, FrankenPHP or LiteSpeed (mod_php is the most exposed)
- Your PHP is older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or is 8.1 or older
If someone gets in, they can:
Your data is taken
Customer records, orders and password hashes — anything your site's database holds.
Your keys leak
API keys, payment credentials and passwords in your config files or server memory.
Malware gets installed
Backdoors that survive a later update, crypto miners, or ransomware.
Your site gets hijacked
Defaced, redirected to scams, or injected with card-skimming code on checkout pages.
Your server attacks others
Sending spam or attacking other sites, which can get your domain and IP blacklisted.
Temporary settings and firewall rules help while you wait, but PHP says updating is the only complete fix.
Which one do I need?
Run php -v on your server, or check your hosting panel.
PHP 8.1 and older are end-of-life. The PHP team only published source fixes for them, so the safe move is to a supported PHP 8.
What I do
The same four steps, whichever price you pick.
Step 1
Check
Confirm your PHP version, how it runs (PHP-FPM, mod_php, LiteSpeed…) and whether you're exposed.
Step 2
Back up
Snapshot or back up the server first, so there's a way back.
Step 3
Upgrade
Install the patched PHP, keep your extensions and settings, restart the services.
Step 4
Verify
Surface check: the site loads, key pages respond and the PHP error log is clean. Then a short before/after report.
Questions
What is PHP2Shell?
Two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October 2026. They can let an attacker run code on your web server without logging in. PHP rates them 9.2 out of 10, and CISA has asked everyone to patch immediately. See "What happened" above for the full story.
Which one do I need?
If you're on PHP 8.2 or newer, the $20 minor upgrade. If you're on PHP 8.1 or older, those versions are end-of-life and get no official release, so you need the major version upgrade, from $70. Not sure? Send me what you have and I'll check before you pay anything.
Can't I just change a setting or turn on a firewall instead?
Not safely. PHP published some temporary setting changes, but says they don't make a server safe and that updating is the only complete fix. Firewall rules from Cloudflare and others block known attacks only, and only for traffic that goes through them. Use them while you wait, not instead of patching.
Is the price per server?
Yes — one server running one PHP version. If you have several servers, or several PHP versions on one server, tell me and I'll quote the total.
Will a major upgrade break my site?
It can. Older code sometimes relies on things newer PHP removed. After the upgrade I do a surface check — the homepage, login and a few key pages load, and the error log is clean. If anything breaks, I send you the errors so your developer can fix them, and I can roll back to the backup if you need the site up in the meantime. The starting price of $70 covers the PHP upgrade only, not code changes.
Do you test my whole app?
No. I'm patching your server, not taking over as your developer, so I don't go into your code or test every feature. I check the surface: the site loads, key pages respond, and PHP isn't logging new errors. Please have your developer or team run through your important flows (checkout, forms, logins) after the upgrade.
What access do you need?
SSH with sudo, or your hosting control panel (cPanel, Plesk, aaPanel and similar). On shared hosting where the host controls PHP, I can switch you to a patched version if the panel allows it; otherwise I'll tell you exactly what to ask your host for.
I use Docker, Laravel Forge or a managed host. Can you help?
Yes. For Docker I update the base image and rebuild. For Forge, Ploi, RunCloud and similar I upgrade through the panel. Managed hosts often patch for you — I can confirm whether yours has.
How does payment work?
Invoiced in USD. Payment details are sent with the invoice.
Don't wait on this one.
Tell me your PHP version and where it's hosted. I'll reply within 24 hours.