Security & Patch Management
PHP2Shell patch service. Your PHP servers fixed today.
On October 21, 2026, PHP released fixes for two critical flaws that let an attacker run code on your server with one request and no login. We patch your Droplets, VPSs and containers to the fixed release, prove your site still works, and roll back if it doesn't.
- ✓ Fixed price per server
- ✓ Same-day turnaround
- ✓ Snapshot and rollback on every job
Is your PHP version affected?
Paste the output of php -v or just the version number.
| Branch | Fixed in |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1 and older | No fix: upgrade |
What PHP2Shell is
No login needed
The flaws trigger during request handling, before your application code runs. A single crafted request is enough. Rated 9.2 of 10.
Every web-facing PHP setup
PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are all in scope. Apache mod_php setups are considered most at risk.
Attacks already started
Attack attempts were reported before the patch was published, and working exploits have been demonstrated publicly.
Secrets can leak
One flaw is reported to expose data held in server memory. Exposed servers should rotate passwords, API keys and TLS keys after patching.
If you run PHP yourself, nobody is patching it for you
Shared hosts update their own servers. On a VPS, a Droplet or a 1-Click image, the update is your job.
Droplets and VPSs
DigitalOcean, Linode, Vultr, Hetzner, Lightsail, especially older 1-Click LAMP, LEMP and WordPress images.
WordPress and Laravel
Sites and apps on servers you manage, including staging copies and the ones nobody remembers.
Containers
Docker images on an unpatched PHP base stay vulnerable until they are rebuilt and redeployed.
Admin panels and devices
Back-office tools and device management consoles that run PHP underneath.
How to check your servers
Run these on each server and container. The command line and the web server can use different PHP versions, so check both.
After updating, restart PHP-FPM or Apache. Until you restart, the old, vulnerable code is still running.
php -vphp-fpm8.3 -v # use your versiondpkg -l | grep -E '^ii\s+php'docker run --rm your-image php -vHow we patch without breaking your site
Most failed patch jobs skip the backup or upgrade everything at once. We do neither, on every server.
- 01
Snapshot
Full server snapshot, database dump and config copy. No snapshot, no work.
- 02
Baseline
Record PHP version, extensions, services, and response codes for your key pages.
- 03
Patch PHP only
Update just the PHP packages and config-test before restarting. Nothing else changes.
- 04
Verify
Re-run the baseline, read the error logs, test login, forms and checkout.
- 05
Rollback ready
If anything is off we restore the snapshot within 15 minutes. You get a written report either way.
Fixed prices
You get a written quote before we touch anything.
Emergency patch
$299 per server
- ✓ Snapshot, patch, verify, rollback
- ✓ Supported branches 8.2 to 8.5
- ✓ Before/after report
- ✓ 30 days of monitoring included
Breach check
$750 and up
- ✓ Look for signs of compromise
- ✓ Rotate passwords, API keys and TLS keys
- ✓ Check for web shells and new accounts
PHP upgrade
$2,000 and up
- ✓ Move 8.1 and older to 8.2+
- ✓ Done on a cloned server first
- ✓ Compatibility fixes, sign-off, then cutover
After the patch: keep it fixed
Managed security plans from $149 per month: security patches within 48 hours, uptime and malware monitoring, daily backups, firewall rules and a monthly report. Start a plan within 14 days of your patch and we credit the patch fee to your first month.
Get a patch plan today
Tell us what you run. We check which servers are affected and reply with a written plan and a fixed price, usually the same day.
Prefer email? hello@fantasticmode.com
PHP2Shell questions
What is PHP2Shell?+
PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, patched on October 21, 2026. A single unauthenticated web request can lead to remote code execution on the server, before any application code runs.
Which PHP versions fix PHP2Shell?+
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are end-of-life and get no official release; the safe path is upgrading to 8.2 or newer.
I updated WordPress. Am I protected?+
No. WordPress, its plugins and themes run on top of PHP. Updating them does not change the PHP version on your server. Shared hosting providers patch PHP for you; on a VPS, Droplet or your own container, you have to do it.
Will patching break my site?+
A patch within the same branch, such as 8.3.x to 8.3.36, rarely breaks anything. We still take a full snapshot first, test key pages before and after, and restore within 15 minutes if anything is off. Upgrades from 8.1 and older carry real risk, so we do those on a cloned server first.
Is a firewall or WAF rule enough?+
No. Firewall rules from providers such as Cloudflare block known attack patterns and reduce risk while you schedule the update, but they are not a fix. Updating PHP and restarting it is the only complete remedy.
My server was exposed for a while. What should I do?+
Patch first, then check for compromise. One of the flaws is reported to expose data held in server memory, so passwords, API keys, session secrets and TLS keys on exposed servers should be rotated. Our breach check covers this.
What access do you need?+
Nothing for the free check, just your domains. For the patch, a temporary SSH user with sudo or a temporary team invite on your cloud account. We remove our access when done and list every command we ran in the report.
Sources: PHP security release (2026-10-21), CISA alert.
Fantastic Solutions is an independent company and is not affiliated with the PHP Foundation or any hosting provider.