Security response

PHP2Shell check and patch for WordPress and PHP

Two critical flaws in the PHP runtime (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution on affected servers. If you run WordPress, Drupal, or any PHP site, we can check your instances and get you onto a patched release.

What we check

A short, practical audit of the systems that are actually exposed.

• PHP version against the fixed releases: 8.5.12, 8.4.27, 8.3.36, and 8.2.35
• WordPress and other PHP apps: host OS packages, containers, and managed runtimes
• How PHP is served: mod_php, PHP-FPM, CGI, and similar workers
• Internet-facing risk and whether EOL PHP (8.1 and older) needs an upgrade path or vendor backport
• Signs you should treat as urgent: worker churn, odd multipart traffic, unexplained 500s after upload-style requests

What we do

1. Inventory. Map which hosts, containers, and WordPress sites still run vulnerable PHP.
2. Patch or upgrade. Move you to a fixed PHP release, or a vendor-supported backport where that is the only safe option.
3. Verify. Confirm the running version after deploy, and note interim WAF or network controls while anything remains unpatched.
4. Harden the next step. Where you are stuck on EOL PHP, we outline the upgrade so you are not left offline or exposed.

Patching is the only complete fix. WAFs and taking a site offline can buy time. They are not a substitute for a patched runtime.

Who this is for

Operators and product teams who need someone to look at the real stack, not a generic advisory. If your site is down as a precaution, or you are unsure whether hosting already patched you, book a call and we will work through it.