PHP2Shell: I'll check and patch your PHP

What happened

On 21 October 2026 the PHP team shipped patches for two critical flaws in the PHP engine itself, dubbed "PHP2Shell": CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 (BleepingComputer, Tenable FAQ).

They let an outsider run their own code on the server without logging in, before the site's own code runs. Passwords and security plugins don't help.
Affected versions go all the way back to PHP 5.4 (Tenable FAQ).
Highest risk: Apache with mod_php. PHP-FPM, PHP-CGI, FrankenPHP and LiteSpeed are exposed too (watchTowr FAQ, NCSC-NL (GitHub)).
Fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12. PHP 8.1 and older are end-of-life; only minimal backports exist for 7.4, 8.0 and 8.1 (NCSC-NL (GitHub), CISA).
Exploitation attempts have already been observed (SecurityWeek, watchTowr FAQ).
Config tweaks are a stopgap only. The real fix is the patch (BleepingComputer).

BadTrip Software is an independent business, not a CERT or any authority. Facts above come from the linked sources.

Who is affected

WordPress, Drupal, Joomla
PrestaShop and Magento shops
Custom systems, admin panels and tools written in plain PHP
Apps on frameworks nobody supports any more: CodeIgniter 2, Zend Framework 1, symfony 1.x, Kohana, CakePHP 2, Laravel 4/5.x
Sites built once and left untouched for 5–10+ years, often on old hosting or an in-house server

5-minute self-check

Hosting panel (cPanel, Plesk, DirectAdmin…): look for "PHP version" or "PHP selector". Note the full number, e.g. 8.2.34.
WordPress: Tools → Site Health → Info → Server.
SSH: php -v (CLI may differ from the web version). Safer: a temporary <?php phpinfo(); file that you delete immediately.
Compare: safe is 8.5.12+, 8.4.27+, 8.3.36+, 8.2.35+. 8.1 and older are exposed unless your host or distro confirms a backport.
Unsure? Ask your host about CVE-2026-109618 and CVE-2026-109619, or ask me for a free check.

Note: the version tells you about exposure, not whether someone already got in. That takes a log review.

Offer

Quick version check	free
Emergency patch & check (1 site or 1 server)	fixed price, quoted after the free check
Each extra site on the same server	fixed price, quoted after the free check
Legacy code audit (PHP 5.x/7.x/8.0–8.1): mitigation, upgrade plan and quote, wider compromise review	fixed price, quoted after the free check
Ongoing care: updates, monitoring, a direct line	monthly retainer, fixed price, quoted after the free check

You get the exact price before any work starts.

What the patch & check includes

Identify PHP version, SAPI (mod_php, FPM, CGI, LiteSpeed, FrankenPHP), hosting and CMS.
Verify whether it's patched (upstream or host/distro backport).
Look for obvious signs of compromise: suspicious PHP files, new admin accounts, cron jobs, odd log entries.
Patch: PHP update or backported package. If that's not possible right away, a temporary mitigation plus a written upgrade plan.
Test that the site still works.
A short plain-English report: what was there, what I did, what's left.

Out of scope (quoted separately): rewriting the app, a full pentest, cleanup after a confirmed breach.

No risk

If your PHP is already patched and there are no obvious signs of compromise, you pay nothing, and you get that in writing.
The patch fee is credited toward an upgrade or retainer if we start within 60 days.

FAQ

I'm on shared hosting. Isn't this my host's job?

Often, yes. I'll help you confirm they've patched, switch the version in the panel and test the site afterwards.

My site runs on PHP 7 or 5. Now what?

Mitigation and a backport if available first, then a plan to move to a supported version. Old code gets fixed, not thrown away.

Will updating PHP break my site?

It can, especially with old code. That's why I check first, test after, and keep a way back.

What access do you need?

Hosting panel or SSH. You can rotate the credentials afterwards.

Do you work remotely?

Yes, remote by default.

Who are you?

Tomasz Urban, a developer with 15+ years of experience, including PHP and keeping legacy systems alive. Based in Poland.

Get in touch

Tell me what the site or system is and where it's hosted. I'll tell you whether you're exposed and what to do next.

tomasz@badtrip.software

or call: +48 508 767 688

PHP2Shell: your PHP site may be open to strangers.