PHP2Shell: check whether your website needs a PHP update
What the October 21 PHP advisory means, how to verify hosting-provider patches, and when an update needs compatibility repairs.
Service
Update PHP without guessing what will break
Find out whether your website needs a PHP security update, what your host has already fixed, and what must be tested before anything changes. Start with a bounded assessment; agree the update and any compatibility repairs separately.
Start an inquiryAll rates and terms
- $200 USD fixed assessmentOne website on one hosting environment; written findings.
- Assessment creditCredited once toward an agreed repair for the assessed scope.
- Check, then changeUpdates and compatibility repairs need a separate written quote.
Who this is for
For agencies responsible for client websites and owners of WordPress, WooCommerce, Laravel or other PHP applications who need a clear update plan.
- Your host sent a PHP warning, but you do not know whether your website has the fix.
- An older theme, plugin or custom application stops you upgrading confidently.
- An agency needs an assessed, bounded update for a client site under its own brand.
- You need the server update and the website checks documented separately.
What is delivered
- Identify the PHP runtime actually serving the agreed website and who controls its updates; public headers alone are not proof.
- Compare runtime and provider package evidence with the relevant official advisory, including vendor-backported fixes.
- Review the available backup, restore and staging options and identify known compatibility dependencies.
- Deliver written findings: affected, patched, not applicable, or not verified, with evidence and remaining access gaps.
- Recommend the next step and quote any update, staging work or compatibility repairs separately. The assessment itself does not patch the site.
Pricing basis and timeline
| Work | Published rate | What the rate covers | What moves the price |
|---|---|---|---|
| PHP exposure and update assessment | $200 USD fixed assessment Assessment window confirmed after the website, hosting scope and required access are reviewed. No emergency-response time is promised. | One website on one hosting environment: identify its serving PHP runtime, check relevant vendor patch evidence, review update and backup constraints, and deliver written findings with the next steps. The assessment fee is credited once against an agreed update or compatibility repair for that assessed scope. | Fixed assessment only. Applying updates, staging work, compatibility repairs, extra sites or servers, third-party fees and compromise investigation are excluded and require a separate scope. |
The written quote confirms the scope, schedule, payment milestones, revisions, cancellation and handover terms. Ongoing work is optional and separately scoped.
What evidence will you receive?
The assessment records the serving runtime, provider patch evidence and any verification limits. If you commission implementation, handover also records the update applied, relevant service restarts, agreed user journeys checked and remaining issues. A completed update is not a claim that every vulnerability has been found.
Send the website, host and the warning you received
Include the platform, the PHP version if known, whether your host manages updates, and any deadline. Do not send passwords, production keys or customer data through the inquiry form. Access is arranged after scope and price are agreed.
Scope boundaries and exclusions
This is a targeted update and compatibility service. Incident response, forensic investigation and recovery of a compromised server need a separate specialist scope. Acceptance depends on the platform, access and a workable restore plan.
- Patching or staging implementation within the assessment fee.
- Unlimited sites, servers, PHP versions or plugin repairs in one assessment.
- Penetration testing, compliance certification or a guarantee that a website cannot be hacked.
- Malware removal, forensic investigation, breach recovery or around-the-clock emergency response.
- Hosting, software licences and other third-party charges.
The quote identifies any separately available work and third-party costs.
Delivery and handover
- Assess the serving environment. Confirm the website, host, PHP handler and package patch status using authorized access or reliable provider evidence. If a host has already applied the patch, report that finding.
- Agree the implementation. Quote the update, hosting coordination and any compatibility repairs with the affected sites, testing boundaries and release window named.
- Prepare the restore path. For implementation, confirm a usable backup and restore procedure and use a staging environment where available. If a safe release path cannot be established, stop and explain what is missing.
- Apply the authorized update. Use supported upstream releases or the hosting vendor’s patched packages. Coordinate relevant worker or service restarts and verify the serving runtime afterwards.
- Check the website and hand over. Exercise agreed forms, logins, checkout or other important paths using safe test arrangements. Record errors, completed checks and any owner-only checks; repair additional failures only within the agreed scope.
Handover includes the agreed source or access, documentation and verification notes. The quote sets any optional support terms.
The October 21, 2026 PHP advisory covers CVE-2026-109618 and CVE-2026-109619. Updating WordPress or installing a security plugin alone does not update the serving PHP runtime. The PHP2Shell guide explains patch evidence and hosting responsibility. Availability and timing are confirmed before accepting work.
Questions people actually ask
- Does the assessment include fixing the vulnerability?
No. The assessment covers the defined environment review and written findings. Updates, staging work and compatibility repairs are quoted separately. The assessment fee is credited once against an agreed repair for that assessed scope; it is not a refundable deposit or an unlimited repair allowance.
- My host says it has already patched PHP. Do I still need this?
Possibly not. Ask the host to confirm whether the actual serving environment has the fixes for CVE-2026-109618 and CVE-2026-109619, including any backported package patches. If that evidence is clear and the website works, extra remediation may be unnecessary. Paid assessment is for owners who need help resolving uncertainty or planning an update.
- Will updating WordPress and plugins fix PHP2Shell?
Not by itself. These October 21 vulnerabilities are in PHP itself. The serving PHP runtime needs a supported fix from the PHP project or its package vendor. WordPress, plugin and theme compatibility still needs checking when an upgrade changes the runtime.
- What if my old website breaks on newer PHP?
Assess the failing theme, plugin or custom code in a controlled environment. Agree a separate compatibility repair or migration scope before replacing anything. A change of major PHP version can need more work than applying a security patch within an existing supported branch.
- Can you guarantee that my website is secure?
No. Verification concerns the named update and agreed website behavior. It is not a complete security audit or a guarantee against compromise. If compromise is suspected, patching alone does not establish that an attacker has been removed; investigation and recovery require a separate scope.