PHP security patching
Your PHP servers patched against PHP2Shell, including old PHP versions
CVE-2026-109618 and CVE-2026-109619 let anyone who can reach your website run code on your server without logging in. I patch every PHP version you run: supported versions get the official update, old versions get the fix backported into a patched build of the same version, and your own code is fixed where an attack can reach it.
$100 – $1,200 one-time, based on scope
A good fit if
- You run PHP on a VPS, a dedicated server, containers or cloud instances you have root access to
- Some sites are stuck on PHP 7.4, 8.0 or 8.1 and can't be upgraded this week
- You use Apache with mod_php, the setup most at risk
- You want the work checked and written up, not just a package update run
Probably not a fit if
- You're on shared hosting without root access. Only your host can patch PHP there
- Your server is already compromised. That needs incident response and a rebuild first, quoted separately
- You want your app moved to a newer PHP version. That's an upgrade project, quoted separately
How I patch your servers
The same steps whether you have one server or twenty. The guide below explains the vulnerabilities themselves.
01Audit
I list every server, container image and PHP version you run, how PHP is connected to the web server (mod_php, PHP-FPM, LiteSpeed or FrankenPHP), and whether your packages already contain the fix. Distributions often fix PHP without changing the version number, so I check the package changelog, not just the version.
02Mitigate first
Before changing any binaries, I turn off session upload progress and tighten request limits at server level, so the known attack routes are closed within minutes while the real fix is prepared.
03Official updates
PHP 8.2, 8.3, 8.4 and 8.5 are updated to the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12) or your distribution's patched packages. Then PHP-FPM, Apache, queue workers and other long-running PHP processes are restarted, so no worker is left running the old code.
04Patched builds for old PHP
For PHP 7.4, 8.0 and 8.1, I compile PHP from the PHP project's own backport branches, with the same version, extensions and build options as your current install. Your app runs on the same PHP version with the security fix added. For older versions with no published backport, I port the fix to the old source by hand.
05Custom code patches
I review the parts of your application that attackers can push into running out of memory, such as upload handlers and endpoints that parse large input, and add size limits, web server request limits and least-privilege file permissions where they're missing.
06Test, switch over, report
The patched PHP is installed alongside the current one and tested with your sites before switching over, with a rollback plan if anything breaks. You get a written report covering each server, what was changed, how the fix was verified and what still needs upgrading.
What it costs
One fixed price, agreed in writing after a quick look at your setup. These are the usual price points.
$100 – $1,200 one-time, based on scope
- An audit of every PHP version, SAPI and server you run
- Updates to the fixed official release where your PHP version is still supported
- Patched builds for old PHP versions (7.4, 8.0, 8.1, and older ported by hand)
- Fixes in your own code where a vulnerability can reach it
- Before-and-after testing, a rollback plan and a written report
- You pay providers directly
- Server, hosting and any control panel licences
- Paid extended-support PHP builds, if you choose one instead of a backport
- Not included
- Shared hosting where you have no root access (your host has to patch PHP)
- A full penetration test, incident response or malware clean-up, quoted separately
- Upgrading your application to a newer PHP version, quoted separately
- After launch
- Bug fixes for 14 days. After that, changes are quoted, or you can hire me monthly.
- Quick patchMe, one time: $100
- One server on a supported PHP version (8.2 to 8.5): audit, mitigation settings, the official update, restarting every PHP process, and a short report.
- Old PHP versionMe, one time: $300 – $600
- A patched build of PHP 7.4, 8.0 or 8.1 with your exact extensions, installed alongside the current PHP, tested with your sites, switched over with a rollback plan. The price depends on how unusual the build is and how many servers get it.
- Full hardeningMe, one time: up to $1,200
- Several servers or container images, mixed PHP versions, hand-ported fixes for PHP older than 7.4, and custom code patches in your application, plus a check for signs of compromise on servers exposed before patching.
- Your providersYou, directly
- Server and hosting costs, control panel licences, and extended-support PHP builds if you'd rather buy one than use a backport.
How we'll work
You work with me directly from the first call to handover. No account managers, no hand-offs.
01
Free scoping call
30 minutes on what you need, your data and what a good result looks like.
02
Written scope and quote
What's included, what isn't, running costs and the support window, in writing before work starts.
03
Working demo early
You see it working on your own data early and can steer before the rest is built.
04
Build, test, deploy
I build the app and its infrastructure, test it and deploy it to your accounts.
05
Handover and support
Code, documentation and a walkthrough, then bug fixes for the support window.
Questions
Can't I just run apt upgrade?
On a supported PHP version from a patched repository, mostly yes, and the guide below shows how. The usual misses are workers that weren't restarted, a second PHP version on the same server, container images that weren't rebuilt, and hosting panels that ship their own PHP builds. The $100 patch covers all of that.
Is a backported PHP build safe to run?
It's built from the PHP project's own backport branches where they exist, with your existing version and extensions, and tested before switching over. It closes these two vulnerabilities, but old PHP versions have other unfixed bugs, so I'd still plan an upgrade to a supported version.
Will patching break my site?
The official update and a backported build keep the same PHP version, so applications rarely notice. I test before switching over and keep the old binaries ready, so rolling back takes minutes if anything does break.
What access do you need?
SSH with sudo on each server, or access to your container build pipeline. I work on accounts you control and can use a temporary user that you remove afterwards.
Can you tell if we were already hacked?
The full hardening package includes a check for common signs of compromise, such as new PHP files, unexpected cron jobs and suspicious processes. If something turns up, cleaning up and rebuilding the server is quoted separately, and secrets should be rotated.
Do you patch other PHP vulnerabilities too?
Yes. The same approach works for any PHP security release: audit, mitigate, update or backport, test and report.
Related guides
Tell me about your project
A 30-minute call is enough to tell whether this fits and what it would cost. You'll get the scope and quote in writing afterwards.