PHP2Shell · CVE-2026-109618 and CVE-2026-109619
Fix PHP2Shell. Then prove it’s fixed.
Rated 9.2 by the PHP team and 10.0 by watchTowr, with attacks reported before the patch existed. We upgrade or isolate the runtime, verify the build that’s actually running, check for earlier compromise, and hand you a dated record.
Any PHP stack, any host. WordPress, Laravel, Magento, Drupal, custom. Written permission first, backup before every change.
Services
Your site is how people find you. Here’s what we do when it’s at risk.
Most of our clients run a clinic, a firm, a shop or an agency. They aren’t technical, and they shouldn’t need to be. Here’s what usually goes wrong, what we do about it, and exactly what lands in your hands.
Free exposure check
A$0.00 · no sign-up
An exposure verdict in under a minute.
Emergency fix
A$449.00 · per site, fixed price
Patched, then proved.
Monitoring
A$14.95 · per site, per month
Continuous coverage for the next advisory.
You were told it’s fixed. We make sure it is, on your actual site, and hand you the proof.
What’s going on
“We’ve handled it” isn’t something you can show anyone.
- Your host’s email doesn’t say which version, when it was applied, or whether the server was restarted. Those are the three things a client or insurer will ask. U.S. Chamber guide ↗
- A version number can look old and be patched, or look new and still be running the old code. Check guide ↗
- Attacks started four days before the fix existed, so “we patched on Tuesday” isn’t the whole story. BleepingComputer ↗
What we do
- 01Look at what your site actually runs, not what the invoice says
- 02Take a backup, then upgrade a copy first (8.5.12, 8.4.27, 8.3.36 or 8.2.35)
- 03If your app can’t take the upgrade today, put a temporary shield in front of it
- 04Restart, then confirm the version that’s really running
- 05Check for signs someone got in earlier
- 06Write it all down, with dates
What you get
- A site running a fixed version, confirmed
- A way back if anything breaks
- The result of the break-in check
- A one-page record you can forward
- A week of follow-up questions
severity out of 10 from the PHP team. watchTowr rated it 10.0.
CISA alertPrice
A$449.00
per site
One advisory in.One dated record out.
Fits the stack you run
Stage a firewall rule, read the host's PHP build, queue plugin updates, open a pull request. Each connection proposes. You approve.
Exposure, measured
Score exposure from the first check to the verified fix. Every drop is tied to an approved change.
Backups you’ve actually restored
A backup you have never restored is a hope. Each quarter we restore one to a test copy and record that it worked.
Answers backed by evidence
Questionnaire answers link back to the report for each fix.
What we know, with dates
Less guessing. More record.
The facts that matter for a fix, each linked to where it came from. Where sources disagree, we say so.
17 Oct
BleepingComputerFirst reported attempt
Amazon’s MadPot honeypot records an exploitation attempt, four days before disclosure.
21 Oct, 07:43 UTC
Wikipedia summaryCloudflare sees attacks
Reported more than six hours before the patch landed.
21–22 Oct
CISA alertFixed builds ship
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA issues an alert. watchTowr’s sensors catch attempts, none successful.
21–22 Oct
HostingerHosts respond
Hostinger fixed every plan except VPS. Automattic’s hosts were already protected.
22 Oct
Tanium timelineKEV status
Reports at the time said CISA had not listed either CVE in its Known Exploited Vulnerabilities catalog. Check the live catalog.
Where sources differ
Severity
9.2 (PHP team) versus 10.0 (watchTowr)
Exploitation
Attempts reported by Amazon, Cloudflare and watchTowr. watchTowr saw no successes. CISA had not confirmed at the time.
Public exploits
Rapid7: proofs of concept work only on specific OS, PHP and server combinations.
Version checks
Distribution builds and end-of-life backports keep the old number, so a version comparison can mislead in both directions.
Exposure check
Ask once. Know where you stand.
No sign-up. If there’s something you can’t answer, the instructions below show you the quickest way to find out, or we’ll do it for you.
Reads public headers only. Nothing is changed.
The advisory · CVE-2026-109618, -109619
- Fixed builds
- 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35
- Backports
- 7.4 to 8.1, minimal source only
- Reported affected
- 5.4 to 8.5
- Highest risk
- Apache with mod_php
Start with question 1. The verdict appears as you type, and gets sharper with each answer.
How it stays safe
Fixes that ask before they act.
You choose how much runs on its own. Speed, control and cost pull against each other, so we make the trade-off visible and keep the final say with you.
Look, never touch.
Read-only analysis of domains you’ve proven you control. Nothing on the site changes, and findings stay in your account.
- Test a domain you haven’t proven you own or been authorised to test.
- Change anything without a backup and a logged approval.
- Promise a site can’t be hacked. We fix what we found and say what we didn’t cover.
Policy as code
Autonomy you can read, version and audit.
One file states what PatchRig may observe, propose, apply, and never touch. It sits in your repository or ours, and a change to the policy is reviewed like any other change.
“Observe is automatic. Anything that changes a live site is a proposal until a named person approves it.”
Design rule
PatchRig operating principle
# patchrig.policy.ymldomain: northwind-dental.exampleverified: dns-txtautonomy:observe: automatic # read-only, verified domainspropose: automatic # diffs, tickets, host messagesapply: approval # named approver, staged firstactive_testing: signed_scope # never without paperapprovers:guardrails:backup_before_change: requiredrollback_plan: requiredwindow: "Sun 02:00-04:00"
Pricing
What it costs, before we start.
Prices are fixed, in Australian dollars (AUD), per site. Every job starts with a look at what you actually have and ends with a record of what changed. No surprises: you’ll know the cost before we start.
Full check
A written exposure assessment.
- Authorised exposure assessment
- One-page report with severity and evidence
- Prioritised remediation list
- Delivered in 2 business days
Emergency fix
Assess, then remediate.
- Everything in Full check
- Backup, staged upgrade, production change
- Compromise review included
- Rollback plan and dated evidence record
- 7 days of follow-up
Full Package
Remediated, cleaned and hardened.
- Everything in Emergency fix
- Malware cleanup if anything is found
- Firewall, 2-step login, admin lockdown
- Automated backups with a restore test
- 30 days of monitoring and a review call
Monitoring
Continuous coverage.
- Uptime checked every 5 minutes
- PHP version and break-in signs checked every day
- Email with the exact next step
- Backup restore test every 3 months
Compromise review
standalone, per site
A$349.00
Evidence pack
per site
A$399.00
Scoped penetration test
signed scope required
Quoted
Playbooks
Do it yourself, properly.
The working notes behind our service, free. Use them, or hand them to whoever runs your hosting.
FAQ
The questions that decide whether you buy.
Get started
Find out where you stand, this week.
Twenty minutes. We’ll tell you whether this affects your site, what fixing it involves, and what it costs.