Services

PHP2Shell protection — PHP updates and verification

Does your website run on PHP? We review hosting, servers and containers, agree an update plan and deploy the PHP2Shell fix. Work includes configuration backups, compatibility checks, PHP-FPM or Apache restarts and application checks. When an update requires preparation, we agree interim risk reduction and a plan to remove the vulnerabilities.

Scope

  • Identify PHP versions across hosting, servers and containers
  • Check fixes for CVE-2026-109618 and CVE-2026-109619
  • Back up configuration and agree a rollback plan
  • Update PHP or plan migration of a legacy application
  • Restart all relevant PHP-FPM / Apache workers
  • Verify the website, forms and agreed application workflows

Technology and tools

  • PHP
  • PHP-FPM
  • Apache
  • Nginx
  • Docker
  • WordPress
  • WooCommerce

What does PHP2Shell protection include?

We match the work to the actual environment and application requirements. Selecting a new version in a hosting panel is only part of verification.

Environment assessment

We identify the PHP version serving requests, FPM pools, containers and package repositories. We determine where updates can be applied and whether the hosting provider needs to act.

Controlled deployment

We agree a maintenance window, backup and rollback procedure. We review application and extension compatibility, update the relevant environments and restart their workers.

Verification and report

After deployment, we check the running version, configuration, website responses and agreed workflows. You receive a record of changes, remaining risks and recommended next steps.

Patches, mitigations and legacy PHP

An update containing fixes for both vulnerabilities is the complete solution. Interim measures reduce specific attack paths only.

Patched releases

We check PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, a later release containing the fixes, or a verified vendor backport. LTS distributions may retain an older base version number, so we verify the vendor advisory and package changelog.

Interim risk reduction

If an immediate update is not possible, we can disable session.upload_progress.enabled in server configuration and restart workers. This does not remove both vulnerabilities or replace an update. We agree the next steps and review application impact.

PHP 8.1 and older

We assess code, CMS, plugins and extensions for migration to a supported PHP branch. We also check vendor-maintained fixes. Migration scope and tests are agreed before production changes.

Who is this service for?

Support for website and store owners and teams maintaining PHP business applications.

WordPress and online stores

We assess PHP and CMS/plugin compatibility. We agree checks for login, forms, cart and checkout. Any paid test order requires separate agreement.

Applications and containers

We check the agreed instances and deployment configurations and persist settings so they survive restarts and container recreation.

Shared hosting

We assess panel options and confirm patch status with the provider. Where permissions are limited, we prepare a specific hosting request and verify the result after the provider acts.

Scope and budget

Scope and pricing matched to your environment

Assessment and action plan

Individual quote

Inventory of agreed environments, available patches and a proposed scope.

Update and verification

Individual quote

Configuration backup, agreed changes, service restarts and post-deployment checks.

Migration or ongoing support

Individual quote

Separately agreed compatibility work, monitoring and future security updates.

Price and delivery depend on the number of websites and PHP instances, hosting access and application compatibility. Suspected compromise requires a separate incident-response scope. An update alone is not proof of complete website security.

Contact

FAQ

Does updating WordPress fix PHP2Shell?

The vulnerabilities affect the PHP engine. Updating the CMS or plugins alone does not replace patching the PHP runtime serving your website.

Is session.upload_progress.enabled = 0 enough?

No. The PHP team says it reduces confirmed session-related attack paths but does not fully protect against both vulnerabilities. Apply an update containing the fixes and restart the relevant workers.

Do PHP workers need a restart?

Yes. After an update or configuration change, restart the relevant request-serving processes so old workers do not remain in memory.

Can you help without root access?

On shared hosting this depends on the panel and provider permissions. We can assess the environment, prepare a hosting request and verify the result. An entry in .user.ini alone is not treated as sufficient mitigation.

What if the website has already been compromised?

An update does not undo an earlier compromise. We agree a separate scope for preserving logs, investigating impact, restoring operations and replacing affected credentials.

Hacked website recovery

Ongoing website and application support

Official PHP security advisory, 21 October 2026

Last updated: 22 October 2026