Emergency PHP security patch for PHP2Shell, £245 fixed

Who this is for

On 21 October 2026 the UK’s National Cyber Security Centre told organisations to update PHP immediately or take affected systems offline. The flaws, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), are in the PHP engine itself, so every site on an unpatched server is exposed, whatever it is built with. Exploit attempts were reported on the day the fix was published.

If you have a systems administrator, the fix is routine and our article explains it. This service is for everyone else: the business whose developer has moved on, the agency with more client servers than hands, the charity whose website “just runs” on a VPS somebody set up years ago. You tell us where the site is hosted; we make it safe and tell you what we did.

What’s included

1. Confirm what you’re running. The PHP version your web server is actually using (which can differ from the command line), how it was installed, and whether a fixed release is available for it.
2. Update PHP. Through your Linux package manager, hosting control panel or managed host, whichever applies. On shared hosting that means switching your site to a patched PHP version in the control panel and confirming with the host that it is patched.
3. Restart every PHP process. PHP-FPM and Apache keep long-running workers, and a worker that started before the update is still running the vulnerable code. Most “we updated but we’re still vulnerable” cases are a missed restart.
4. Check the site. The home page, the main user journeys and any forms, plus the error log, to catch anything the new version has changed.
5. Written confirmation. A short email stating the version before and after, what was changed, how it was verified and any follow-up we recommend. Keep it for your insurer, your clients or your Cyber Essentials assessor.

We also look for the obvious signs that a server was already compromised before it was patched: unfamiliar PHP files in upload and cache folders, new admin users and unexpected scheduled tasks. If we find something, we tell you straight away and point you to an NCSC-assured incident response provider. A full forensic investigation is outside this service.

What’s not included, and what happens then

The fixed price covers one server (or one hosting account) and the work above. Two things can change the picture, and we tell you before doing anything billable:

• Your code breaks on the patched version. This is rare when moving between patch releases of the same PHP version, but common when a site has to jump from PHP 7.x or 8.0 to a supported version. We roll back, apply the interim mitigations published by the PHP security team so you are protected in the meantime, and quote the upgrade separately. Most of those quotes start with the £350 audit.
• You’re on PHP 8.1 or older. There is no official fix for these versions. We apply the mitigations, confirm they are in place, and give you a written plan and quote for moving to a supported version. The £245 fee still applies for that work.

Prices exclude VAT where applicable. There is no call-out fee, no hourly rate and nothing to pay until the work is done.

How it works

1. Send the form with your website address, where it is hosted (for example “a VPS at Hetzner”, “cPanel shared hosting with 20i” or “a managed WordPress host”) and, if you know it, your PHP version. Don’t put any passwords in the form.
2. We reply within 4 working hours with a confirmed time and how we will get access: usually an SSH key you add to the server, a temporary control panel login or an account with your managed host. If your situation doesn’t fit the fixed price, we say so in that reply.
3. We patch, restart, check and confirm, then remove our own access and ask you to revoke any temporary credentials.

Access and trust

News like this attracts phishing, so be careful who you give access to. We will never ask for passwords by email or through our form; share credentials through your password manager’s sharing feature or a one-time link, and revoke them when we are done. Our work is done over SSH with a named key, every change is listed in your written confirmation, and if you would like to watch over a screen share while we work, you are welcome to.

After the patch

PHP2Shell was found with AI, and OpenAI says it is one of several serious flaws it has found, with more to come. The sites that got through this one in minutes were on a supported PHP version with someone able to patch them. If yours isn’t, the £350 PHP Audit & Roadmap tells you exactly what stands between your code and PHP 8.5, and the fee is credited in full against the upgrade.