Service
PHP Security Patching Service
PHP2Shell is in the PHP runtime itself. Updating WordPress or Laravel won't fix it, but updating PHP will.
PHP 8.2 to 8.5 · PHP-FPM · Apache
4-step process
- 4 clear stagesScan to Hand over
- PHP 8.2 to 8.5, PHP-FPMand 7 more in the stack
- 6 kinds of worklisted below
- Written estimatefixed price, before work starts
What this is
PHP2Shell is the name for two critical flaws, CVE-2026-109618 and CVE-2026-109619, that the PHP project fixed on 21 October 2026. Both can allow unauthenticated remote code execution, and both sit in the runtime, so a perfectly maintained application is still exposed on an unpatched server. We find which PHP version and handler each of your sites really runs on, move it to a fixed release, restart the workers that keep running old code, and check the result in a live request rather than assuming the package manager did its job.
Who this is for
- Businesses with a WordPress, Laravel, CodeIgniter or custom PHP site on a VPS or dedicated server and nobody who manages it day to day
- Teams running several PHP sites across different servers who aren't sure which ones are patched
- Owners on shared hosting who need to ask the right questions and get a straight answer from their provider
- Anyone who patched once and wants it verified, including whether old workers are still running
What problem this solves
If two or more of these sound familiar, it is worth a conversation.
Updating the application doesn't help
WordPress, plugins and frameworks sit on top of the runtime. The flaw is underneath all of them, so the fix has to happen at the PHP level.
Nobody knows which PHP is really running
The command line, the web server and a container can each use a different build. We check the one that serves requests.
A package update without a restart changes nothing
Old PHP-FPM or Apache workers keep running the vulnerable code until they're restarted. This is the step most often missed.
Distros backport fixes without changing the version number
A version string can look old and still carry the fix. We read the changelog for the CVE numbers instead of guessing.
What Nimbryx actually builds
Every one of these is built around how your team already works.
Server inventory
Every site, PHP version and handler (mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed) listed in one place, with the highest-risk setups first.
Update to a fixed release
PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 for the branch you're on, applied on staging first where the app is fragile.
Interim hardening
The settings the PHP project recommends while a full update is pending, like disabling session upload progress and capping request sizes. Applied at server level and documented as partial.
Worker restart & verification
Workers restarted and the live version confirmed from a real request, not only from the terminal.
Log review
A look through logs for the patterns the PHP guidance flags, such as oversized session cookies, runs of 500 errors and unexplained worker restarts.
Short written report
What was running, what changed, what's still open. Plain language you can forward to your host or your board.
How this typically works
From the first conversation to a working system.
Step 1
Scan
You tell us the servers. We list what's running, confirm the handler and flag anything on an unsupported PHP branch.
Step 2
Plan
A short written plan with the order, the maintenance window and what could break, agreed before we touch anything.
Step 3
Patch
Update, restart, test the critical pages and forms, then confirm the version on live traffic.
Step 4
Hand over
Report plus a simple routine for your next update, so it doesn't depend on one person remembering.
The stack we’d likely use
Mature, well-supported tools. The final choice depends on your project, and we explain it before we start.
- PHP 8.2 to 8.5
- PHP-FPM
- Apache
- Nginx
- LiteSpeed
- Docker
- Ubuntu / Debian
- WordPress
- Laravel
An honest note
When this isn't the right call
If you're on shared hosting, your provider controls the PHP runtime and we can't patch it for you. We can help you word the request and check their answer, and if they're slow, plan a move to a host that publishes its patch status. We'd rather say that upfront than quote you for work we can't do.
Not sure which side of the line you’re on? Ask us and we’ll say so.
Does updating WordPress fix PHP2Shell?
No. PHP2Shell is in the PHP runtime. WordPress and its plugins run on top of it. You need the PHP build on the server updated to a fixed release.
Which PHP versions are fixed?
8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get updates from the project, although source backports exist for 7.4, 8.0 and 8.1 and some vendors ship their own.
Can you patch it without downtime?
Usually the interruption is a few seconds while workers restart, and we schedule it for a quiet hour. If your setup has several servers behind a load balancer, we update them one at a time.
How much does it cost?
It depends on the number of servers and how old the PHP is. We confirm a fixed price in writing after a quick look at what you run, before any work begins.
Ready to talk about your project?
Tell us what you're trying to build. We'll reply within one business day with honest thoughts, not a sales pitch.
- First conversation is free
- Written estimate before anything starts
- You own the code