PHP2Shell website fix
Is your website safe from PHP2Shell?
A security hole in PHP, the software most WordPress websites run on, lets someone take over a website without logging in. The fix came out on 21 October 2026. If your site doesn't have it yet, we'll put it on for you.
Get my website checkedWhat happened
PHP2Shell is the name for two flaws in PHP, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for how serious they are.
The details leaked on 20 October, a day before the fix was ready, and code to attack it is now public.
The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older won't get a fix, so a site on an older version has to move to a newer one.
Is my site affected?
- Your website runs on WordPress, or on anything else built with PHP.
- Nobody has updated it in a while.
- Your web host hasn't told you the fix is on your site.
If any of these sounds like your site, it's worth a check.
What we do
01
Check it
We find out which version of PHP your site runs and look for signs that someone has already been in.
02
Back it up
We copy the whole site before we change anything, so nothing can be lost.
03
Update it
We update WordPress, your theme and your plugins, then move the site onto a version of PHP that has the fix.
04
Test it
We open every page and send every form to make sure it all still works, then tell you it's done.
The price
From $340
Canadian dollars
That covers four hours of work, which is enough for most websites.
Some sites need more, for example one that has already been hacked. If yours does, we'll tell you before we do any extra work.
Send the form and we'll start within one or two business days.