PHP2Shell repair: check your PHP, apply the fix

Help with CVE-2026-109618 and CVE-2026-109619. One-time repair €99, with a money-back guarantee.

Updated 24 October 2026

Does this affect my website?

These vulnerabilities are in the PHP runtime. Updating WordPress or a plugin alone does not update PHP. Check the PHP version used by the website, its execution mode and the package vendor’s security status. The command-line PHP version may differ from the web server’s version.

Which upstream versions include the fixes?

PHP 8.2.35
PHP 8.3.36
PHP 8.4.27
PHP 8.5.12

These are branch-specific fixed releases; later releases in the same branch also include the fixes. Distributions may backport patches into differently numbered packages. For older branches, ask your host about a supported patched build or a compatible upgrade.

What we help with

Identify the PHP runtime serving your website, check the vendor fix, preserve a backup, update the appropriate package or image, restart affected workers and check key website functions afterwards. If you only have a hosting control panel, tell us which provider you use.

Money-back guarantee. If we can’t fix your problem, we’ll refund your payment in full. VAT added where applicable.

Can you check without breaking my site?

Our public website check makes an ordinary homepage request. It does not attempt exploitation and cannot confirm every PHP deployment. Repair assessment uses installed package and configuration information after access is arranged.

Start with a free public check

Official technical details

CVE-2026-109618 explained · CVE-2026-109619 explained · More PHP advisories