PHP2Shell response for business websites and agency portfolios. Get a clear answer, a carefully scoped update, and proof of what changed.
Patched. Checked.
Documented.
8.3.358.3.36For the platforms you run every day
Public posts on X from national cybersecurity agencies on 21 October 2026, quoted in their original language.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or…
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially…
🚨 Organizations should immediately patch critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. These vulnerabilities enable unauthenticated #RCE and affect PHP installations serving web requests.
The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.
❗ ALERT UPDATE ❗ Patches are now available for two critical PHP vulnerabilities. If your organisation uses PHP, we recommend identifying affected systems, reviewing official PHP guidance and applying appropriate mitigations as soon as possible
#CyberAlert | AL26-026
Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619
The Cyber Centre is aware of critical vulnerabilities affecting PHP.
⚠️ Une mise à jour de PHP a été publiée.
Elle corrige deux vulnérabilités critiques dont l’exploitation rapide est à craindre.
Vanwege de kwetsbaarheden in PHP hebben wij uit voorzorg onze website (ncsc.nl) tijdelijk offline gehaald. We adviseren voorbereidingen te treffen op een komende patch op 21 oktober 16.00 uur.
Quoted from public posts. These agencies are not affiliated with Patch Response and do not endorse our services.
A fully updated website can still run on an unpatched PHP runtime. We establish what your web server actually uses, then agree on the right next step.
Understand PHP2ShellIdentify the PHP build serving your application, including separate pools and containers within the agreed scope.
Vendor backports matter. We check package provenance and security advisories, not just a version number.
Document the update, confirm restarted processes, and check the application paths your business relies on.
No changes without an agreed scope.
No handover without a written record.
We review your web runtime and vendor patch status. You get a clear outcome: patched, needs action, or requires more evidence.
Agree the maintenance window, prepare a backup and rollback plan, and apply a supported update to the scoped environment.
Confirm the running version, test the agreed application functions, and receive a concise change report with any remaining actions.
Start with one environment.
Scale to your client portfolio.
A clear answer
€190 / one-time
Know what needs attention before making changes.
Purchase report for €190The complete standard update
From uncertainty to action
€590 / one-time
A scoped update, with your application checked afterwards.
Start with the €190 reportFor your client portfolio
€1,490 / one-time
One view of the environments you look after.
Discuss your portfolioPrices exclude applicable taxes. Standard remediation covers one supported server and one application, subject to assessment. Major upgrades and incident investigation are quoted separately.
Full service scopeWhen every client asks the same question, you need a coordinated response. Get a portfolio inventory, a prioritised plan, and reports ready to share under your name.
Let’s review your portfolio Start with one agreed pilot. Expand with confidence.Understand the scope
before you commit.
Not on its own. These vulnerabilities affect the PHP runtime beneath your application. WordPress, plugin and theme updates do not replace the required PHP security update.
Your hosting provider may already have handled it. Ask for confirmation covering your actual PHP runtime and package. If you have that evidence, you may not need our service. Verification is useful when the status is unclear or you need a documented view across several environments.
Cloudflare has deployed WAF mitigations, but also recommends patching PHP. A firewall is an additional layer of protection, not evidence that your PHP runtime has been updated.
We check whether a supported vendor security backport is available. If a larger upgrade or application change is needed, we scope it separately. Major PHP migrations, operating-system upgrades and application rewrites are not included in the standard patch package.
We confirm availability after reviewing your environment. The agreed work window depends on scope, access and backup readiness. We do not make changes before the scope and maintenance window are approved.
No. Verification documents the patch status and agreed functional checks. A previous compromise requires a separate investigation. If we see signs that warrant investigation, we flag them and discuss the next steps.
Technical guidance reviewed 22 October 2026. Refer to the PHP advisory for the latest information. Managed hosting may already include the required update.