Critical PHP flaw. Old versions won't get an official fix.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets an attacker run their own commands on your server. Find out if your application is exposed, and what it takes to close the gap.

  • RATED CRITICAL. Attack traffic was hitting PHP sites hours before the announcement.
  • Only PHP 8.2 and newer are officially patched.
  • Your database, API keys and connected systems are exposed.

Is your application exposed?

Book a free 30-minute call with a senior PHP engineer. We'll check your exposure and your options.

Pick a time on the next screen.

What to do now

Your next step depends on the PHP version you run.

1

On PHP 8.2 or newer

Update right away to a patched release:

8.5.128.4.278.3.368.2.35
2

On anything older

There's no official patch. Ondřej Surý has backported the fix for sites using his Debian and Ubuntu packages on recent releases. Otherwise, the fix is upgrading.

3

Running internal tools

Subdomains aren't private, and bots probe everything they can find online. Update internal systems too.

How we help

A senior engineer in 24-48 hours

We put a senior PHP engineer on your upgrade, working directly with your team.

A patched build while you plan

Not ready for a full upgrade? We can move you onto a patched build first, then plan the upgrade properly.

16 years in PHP, Laravel and Symfony

We upgrade old PHP applications safely, without stopping the business.

Full-time near-shore employees

Not freelancers. Our engineers own the work from coding to deployment, with $0 up front.

Don't wait for the next wave of attacks.

Book a free 30-minute call with a senior PHP engineer this week.

Check my application
© SimplyPHP