Actively exploited: CVE-2026-109618 & CVE-2026-109619 (“PHP2Shell”) Fixed in PHP 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35 — patch now
Quillhand Get an exposure checkGet a check
PHP2Shell emergency response

PHP2Shell is being exploited right now. We'll check, patch and shield your sites — today.

Two critical flaws in PHP itself let attackers take over a web server without logging in. If your business runs WordPress, Drupal, Magento, Laravel or any other PHP site, you need to know where you stand — fast.

Get an exposure check Patch it yourself
Exposure check needs only your domains Reply within one business day
PHP2Shell exposure report
shop.example.com Vulnerable PHP 8.3.12 · PHP-FPM · fix: 8.3.36
blog.example.com Vulnerable PHP 7.4.33 · no official patch · WAF + upgrade
portal.example.com Verify Version hidden · managed host · confirm with provider
www.example.com Patched PHP 8.4.27 · upload progress disabled
Next steps: patch shop today, shield blog with WAF rules, get written confirmation from portal's host.

Sample report for illustration.

What's happening

A bug in PHP itself — not a plugin, not a theme.

On October 21, 2026 the PHP project shipped emergency fixes for two flaws that had been hiding in the language for years. Exploit code is public and attacks are already widespread, so this is not a “next maintenance window” problem.

5.4 → 8.5Every PHP version that serves web traffic, until patched
9.2Severity score (CVSS) for both flaws — critical
~2M+Internet-facing servers advertising a vulnerable PHP version
Oct 17First exploitation seen — four days before the public fix
CVE-2026-109618

Out-of-memory corruption

When PHP runs out of memory while it is still setting up a request, its cleanup treats half-built data as valid. An attacker can steer that into running their own code on your server.

CVE-2026-109619

Leftover state between requests

One request can leave behind a pointer to memory that's already been freed. A later request to the same PHP worker can use it to take control — no login required.

Affects PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Sources: Tenable, The Hacker News, Krebs on Security, OX Security.

How we help

Three services. Pick one, or let us run all three.

Most businesses need to know what's exposed, fix what can be fixed today, and protect what can't. Every engagement is fixed-fee, quoted after a free 30-minute triage call.

01

Exposure check

Find out exactly which of your sites and servers are vulnerable — before an attacker does.

  • Inventory of your public domains and subdomains
  • PHP version and server setup for each one
  • Host and vendor patch status confirmed
  • No server access needed — just your domains

You get: a plain-English report ranking every site as vulnerable, verify or patched, with the fix for each.

02

Emergency patching

We upgrade PHP to a fixed release safely, with a tested rollback, on your schedule — nights and weekends included.

  • Upgrade to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 — or your distro's backport
  • Hardening settings applied and locked
  • All PHP workers restarted, site tested end to end
  • We coordinate with your host if you're on shared hosting

You get: patched servers and a written confirmation you can show customers, insurers or auditors.

03

Virtual patching

Can't upgrade today — or running an old PHP 7.x app with no official fix? We block the attack in front of your site.

  • Web application firewall rules on Cloudflare, AWS WAF or ModSecurity
  • Tuned so real customers aren't blocked
  • Monitoring of blocked attempts
  • A clear upgrade plan, so the shield isn't permanent

You get: protection within hours, and time to upgrade properly.

Already seeing strange admin accounts, unknown files or a defaced page? Tell us in the form — we'll flag it right away and point you to incident response.

Patch it yourself

Have a technical team? Here's the fix.

If you manage your own servers, these three steps close the hole. Get stuck, or can't upgrade? That's what we're here for.

Step 1

Upgrade PHP

Move to the fixed release for your branch:

8.5 branch8.5.12 8.4 branch8.4.27 8.3 branch8.3.36 8.2 branch8.2.35

On 8.1 or older there's no official fix — use your distro's backport, upgrade, or shield it.

Step 2

Harden php.ini

Until every server is upgraded, these settings reduce the risk:

session.upload_progress.enabled = 0
; PHP 8.5 only:
fatal_error_backtraces = 0

These are stopgaps, not a fix.

Step 3

Restart every worker

A patch does nothing until PHP reloads. Restart PHP-FPM pools, Apache (for mod_php) and any long-running workers, then confirm the new version with php -v and from a live page.

On shared or managed hosting you can't do this yourself — your host must. We'll check whether they have.
How it works

From request to protected, usually within days.

1

Send your domains

Fill in the form below. It takes two minutes.

2

Free triage call

30 minutes to understand your setup. You get a fixed quote, no surprises.

3

We fix it

Check, patch and shield — scheduled around your business hours.

4

Written confirmation

A short report of what we found, what we changed and what's left.

Questions

Frequently asked questions

Am I affected?
If any of your websites or apps run on PHP — WordPress, Drupal, Joomla, Magento, Laravel and most shared hosting all do — and PHP hasn't been updated since October 21, 2026, assume yes. Every version from 5.4 up to the fixed releases is vulnerable.
We run PHP 7.4 or 8.1. Is there a patch?
Not from the PHP project — official fixes only shipped for 8.2 and newer. Your options are a backported fix from your Linux distribution or host, upgrading PHP, or virtual patching with WAF rules while you plan the upgrade.
I'm on shared or managed WordPress hosting. Isn't my host handling this?
Many hosts are patching, but on their own schedule and not always completely. We verify which version your site actually runs and, where needed, push your host for written confirmation.
Do you need access to our servers?
Not for the exposure check — we only need your domains. For patching we need scoped, temporary access that you revoke when we're done.
Is a WAF enough on its own?
No. WAF rules block known attack patterns and buy you time, but attackers adapt. Virtual patching is a bridge to a real patch, not a replacement.
What if we've already been hacked?
Exploitation started as early as October 17. If we see signs of compromise during our work, we tell you immediately and refer you to an incident-response firm. Patching a compromised server does not remove an attacker who is already inside.
Get an exposure check

Tell us where your sites are. We'll tell you where you stand.

We reply within one business day to set up a free 30-minute triage call. Prefer email? Write to hello@quillhand.com.

  • No server access needed to start
  • Fixed quote before any work begins
  • Your details are used only to respond to this request
Seeing anything unusual? (unknown admin users, strange files, defaced pages, slowdowns)

Got it — thank you.

We'll reply within one business day to set up your triage call. If it's urgent, email hello@quillhand.com with “URGENT” in the subject.