PHP2Shell · October 21, 2026 security release
A site that cannot take the patched PHP build
Prepaid discovery first. The repair is a separate estimate you can accept or decline.
On October 21, 2026, the PHP project shipped emergency fixes for two critical vulnerabilities, widely called PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619. The patched builds are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Hosts are moving sites onto those builds. A plugin, theme, or piece of custom code often fatal-errors on the way there. Updating WordPress is a different job from updating PHP, and PHP 8.1 and older no longer receive security releases from the PHP project. PHP 8.2 security support ends December 31, 2026, so a site that only reaches 8.2.35 still has another move ahead.
A NARROW FIRST STEP
What the discovery covers
One site. The current PHP version, what blocks a patched or supported build, and a written estimate for the repair.
- The PHP version the site is on now, and whether the host is already serving a patched build.
- Which plugin, theme, or custom code fails when the site moves to a patched build or a supported branch.
- Whether the immediate step is a same-branch patch or a version jump.
- A written repair estimate. You can proceed with that work or stop after the discovery.
The fee is fixed and paid before the discovery starts
I confirm the discovery fee in writing before you commit. Discovery does not include production changes. The repair, if you want it, is priced separately after the findings.
This is not the broader technical assessment
The PHP discovery looks at the upgrade block on one site. The $5,000 technical assessment is a wider review of an application, its hosting, and its integrations. A monitoring plan and an ongoing partnership are separate services. A site that is safely on a supported PHP version can move into custom development, monitoring, or an ongoing partnership when that is the right next step.