Feeling insecure?
Your website may be exposed.
PHP2Shell is unauthenticated RCE in the PHP runtime, and PHP runs about 70% of websites. PatchRig™ verifies exposure, remediates on a staging copy and attests the fix across PHP, Laravel, Symfony, WordPress, Drupal and Node.
Free exposure scan in under a minute, no sign-up. Or book a call.
Works with
PHP, Laravel, Symfony, WordPress, WooCommerce, Drupal, Joomla, Node.js
Critical, and already exploited.
Tracked by PHP, CISA and Rapid7.
Severity
9.2 out of 10
PHP’s own security team rates how dangerous it is at 9.2 out of 10, which is critical
CISAImpact
Remote code execution
An unauthenticated attacker can run commands on your server, which means data access, malware or changed pages
Rapid7Scope
Below the CMS
The flaw is in the PHP runtime, beneath WordPress, Laravel and every plugin. A CMS or plugin update can’t reach it
MalCareWho’s affected
70% of sites
About 70% of websites with a detectable server language run PHP, including WordPress, Laravel, Drupal and Magento
W3TechsHow fast
4 days early
Attacks were recorded four days before the fix was released, so a site can be hit before anyone knows it needs patching
BleepingComputerRemediation
Patch, then restart
Fixed builds exist for PHP 8.5, 8.4, 8.3 and 8.2. They protect a site only once they’re installed and PHP is restarted
CISAAlso being exploited now
What we do
Three steps, one clear outcome each.
Check
Confirms which PHP version is actually running and whether it has the fix. A full vulnerability assessment also covers plugins, exposed files and server settings.
A clear answer, in minutes
Fix
Closes the flaw, checks for signs of an earlier break-in, and cleans up and responds if anything turns up.
Closed, cleaned and confirmed
Prove
A report with the date, what was found and what changed. Monitoring then watches for the next flaw.
A report to keep on file
Exposure check
Ask once. Know where you stand.
No sign-up. If there’s something you can’t answer, the instructions below show you the quickest way to find out, or we’ll do it for you.
Reads public headers only. Nothing is changed.
The advisory · CVE-2026-109618, -109619
- Fixed builds
- 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35
- Backports
- 7.4 to 8.1, minimal source only
- Reported affected
- 5.4 to 8.5
- Highest risk
- Apache with mod_php
Start with question 1. The verdict appears as you type, and gets sharper with each answer.
Findings, fixes and proof, in one report.
security check · shop.com.au
2
findings
4
checks passed
PHP 8.1.2
version reported
- CRITICAL
PHP 8.1.2 reported
End of life since 31 Dec 2025. No fixed release for PHP2Shell.
→ Upgrade to PHP 8.4 or newer
- HIGH
Debug mode appears on
Detailed error pages can reveal passwords and keys.
→ Turn debug off in production
- PASSED HTTPS certificate valid
- PASSED No .env file exposed
- PASSED No signs of an earlier break-in
- PASSED No malware found
Fixes for the stack you already run.
Works with
PHP
Laravel
Symfony
WordPress
WooCommerce
Drupal
Joomla
Node.js
Runtime
Frameworks and CMS
Dependencies
Common web flaws
Injection and exposed files
SQL injection, cross-site scripting and exposed config files, found and fixed at the source
GuidesOne advisory in.One dated record out.
Exposure, measured
Score exposure from the first check to the verified fix. Every drop is tied to an approved change.
Answers backed by evidence
Questionnaire answers link back to the report for each fix.
Spot the signs of a break-in the day they show.
Free exposure check
An exposure verdict in under a minute.
Reads the PHP version your site reports and returns a verdict: fixed, exposed or unknown. No sign-up.
- Result in under a minute
- Shows the PHP version your site reports
- Says clearly when it can’t tell
Emergency fix
Patched, then proved.
A critical flaw such as PHP2Shell is fixed on a copy of your site first, then switched over, and the fix is confirmed on the live site.
- Fixed on a copy first
- Fix confirmed on the live site
- Rollback plan
- 7 days of follow-up
Monitoring
Continuous coverage for the next advisory.
Uptime is checked every 5 minutes. PHP version and indicators of compromise are checked every day. When something needs action, an email gives the exact remediation step.
- Uptime checked every 5 minutes
- PHP version checked every day
- Break-in signs checked every day
- Email with the exact next step
Need a full clean-up, an evidence pack or a penetration test? Book a call.
Questions
Before you decide.
Find out where you stand, this week.
Twenty minutes. We’ll tell you whether this affects your site, what fixing it involves, and what it costs.