# KEYWORDS · php2shell service page

Drafted Thu Oct 22, 2026 (PT). Section names refer to `PAGE-COPY.md`.
No search-volume numbers are given on purpose: none were measured, and we don't invent them. If json wants volumes, pull them from Search Console or a keyword tool after launch and add them here with the date.

Rule for the crew: every keyword below shows up only where it answers a real question. No keyword stuffing, no hidden text, no white-on-white, no off-screen blocks, no keyword lists in the footer. Google treats those as spam, and readers notice too.

---

## 1. Page meta

| Item | Proposed | Notes |
|---|---|---|
| URL slug | `/services/php-patch/` | Matches the live `/services/...` pattern (e.g. `/services/wordpress-migration/`, `/services/care-plans/`). Alternate: `/php-patch/`. json decides. Don't put the CVE ID or "php2shell" in the slug: the page should outlive this one event. |
| Title tag | `PHP Patch Help for php2shell (CVE-2026-109618) \| JKCA Studio` | ~60 characters. Front-loads "PHP patch" and the nickname. |
| Meta description | `Fix the php2shell PHP flaws (CVE-2026-109618, CVE-2026-109619). Check your PHP version, update to a fixed release and verify it. Free check, Seal Beach studio.` | 159 characters. No prices, no urgency words. |
| H1 | Patch and verify your site for the October 2026 PHP flaws | One H1 only. |
| OG title | PHP patch help for the php2shell flaws | |
| OG description | Check your PHP version, get the fix live, and confirm it worked. A calm, plain-words guide and service from JKCA Studio in Seal Beach. | |
| Canonical | `https://jkca.studio/services/php-patch/` | Update if slug changes. |

## 2. H1/H2 outline

- H1: Patch and verify your site for the October 2026 PHP flaws
  - H2: What are the php2shell PHP flaws?
  - H2: Is my site affected?
  - H2: How to check your PHP version
  - H2: PHP patch help, in four sizes
    - H3: Free PHP check
    - H3: Patch and verify
    - H3: Patch, verify and check for trouble
    - H3: PHP 8.1 or older: patch, then upgrade or move
  - H2: What happens after you get in touch
  - H2: Common questions about the PHP flaws
    - H3 x 19 (the FAQ questions)
  - H2: Not sure where your site stands?

## 3. Keyword map

### Primary
| Keyword / phrase | Answered in |
|---|---|
| php2shell | Hero, "What are the php2shell PHP flaws?", FAQ "What is php2shell?" |
| php2shell fix | FAQ "What is the php2shell fix?", Tiers |
| CVE-2026-109618 | Hero, What it is, FAQ "Is the CVE-2026-109618 patch out?" |
| CVE-2026-109619 | Hero, What it is, FAQ "Which PHP versions fix..." |
| PHP vulnerability October 2026 | H1, What it is |
| PHP patch / patch PHP | H1, Tiers ("Patch and verify") |
| WordPress PHP vulnerability | FAQ "Is my WordPress site affected by the PHP vulnerability?", What it is |

### Secondary
| Keyword / phrase | Answered in |
|---|---|
| PHP remote code execution / PHP RCE | What it is ("remote code execution") |
| PHP critical vulnerability CVSS 9.2 | What it is, FAQ "Is the score 10.0 or 9.2?" |
| CVE-2026-109618 CVSS 9.8 NVD | FAQ "Is the score 10.0 or 9.2?" (explains NVD's v3.1 score) |
| CVE-2026-109618 CVSS 10 | FAQ "Is the score 10.0 or 9.2?" (corrects it) |
| patch PHP 8.3 / PHP 8.3.36 | Who is at risk table, Check yourself step 4 |
| PHP 8.2.35, PHP 8.4.27, PHP 8.5.12 | Who is at risk table, FAQ "Which PHP versions fix..." |
| how to check PHP version | Check yourself, FAQ "How do I check my PHP version?" |
| check PHP version WordPress | Check yourself step 1 |
| PHP 8.1 end of life | Tier 4, FAQ "PHP 8.1 end of life: what do I do?" |
| emergency WordPress security | Hero, Tiers |
| WordPress security patch help | Tiers, Closing CTA |
| website hacked help | Tier 3, FAQ "Was my site hacked?" |
| CISA PHP alert | What it is (sources), FAQ "Do I need to take my site offline?" |
| php2shell exploited | FAQ "Is php2shell being exploited?" |
| Drupal / Joomla PHP vulnerability | FAQ "Are Drupal, Joomla and other PHP sites affected?" |

### Long-tail (question form)
| Query | Answered in |
|---|---|
| is my WordPress site affected by the PHP vulnerability | FAQ (same wording) |
| how do I check my PHP version | FAQ (same wording), Check yourself |
| CVE-2026-109618 patch | FAQ "Is the CVE-2026-109618 patch out?" |
| my host says I'm patched how do I verify | FAQ (same wording), Check yourself step 6 |
| PHP 8.1 end of life what do I do | FAQ (same wording) |
| PHP 8.1 patch php2shell / PHP 7.4 patch build date | FAQ "PHP 8.1 end of life: what do I do?", Who is at risk table |
| Plesk PHP 8.1.34 build date / alt-php81 CVE-2026-109618 | FAQ "My PHP version number didn't change..." |
| was my site hacked signs | FAQ "Was my site hacked? What signs should I look for?" |
| PHP version didn't change after update ubuntu backport | FAQ "My PHP version number didn't change..." |
| do I need to restart php-fpm after update | FAQ "Do I need to restart anything after patching PHP?" |
| does cloudflare protect against php2shell | FAQ "Does a web firewall or Cloudflare protect me?" |
| should I take my website offline PHP vulnerability | FAQ "Do I need to take my site offline?" |
| change WordPress salts after hack | FAQ "Should I change my passwords and keys?", Tier 3 |
| which PHP versions are affected by CVE-2026-109619 | Who is at risk table |
| is CVE-2026-109618 in CISA KEV | FAQ "Is php2shell being exploited?" (links KEV in Sources). Re-check status before launch. |

### Local
| Phrase | Answered in |
|---|---|
| website hacked help Seal Beach | FAQ "Do you only help sites in Seal Beach?", hero small line |
| WordPress security Long Beach | FAQ "Do you only help sites in Seal Beach?" |
| emergency website help Orange County | FAQ "Do you only help sites in Seal Beach?" |
| PHP patch service near me | Same FAQ + LocalBusiness `@id` in JSON-LD |

Internal links that support local terms (existing live pages): `/services/seal-beach/`, `/services/orange-county/`. Add one plain link to each from the "Do you only help sites in Seal Beach?" answer on the page if the crew wants, but keep the JSON-LD answer text identical to what's visible.

### Buzz phrases (use once, where natural, or not at all)
- "php2shell" / "PHP2Shell": either casing is fine; pick lowercase in body text and keep it consistent.
- "PHP RCE": OK in one spot. Spell out "remote code execution" first.
- "Leaked CVSS 10": only in the correction FAQ. Never as a headline.
- Avoid: "zero-day" (patches exist), "mass hack", "the internet is on fire", "act now", any counts of hacked sites. These are scare copy or unsupported.

## 4. Internal and outbound links
- Out (cite, normal follow): PHP Foundation, php.net, CISA alert, CISA KEV, Canada's Cyber Centre, CERT-EU, oss-security, AWS, Wiz. See Sources block in PAGE-COPY.md.
- In: `/services/wordpress-migration/`, `/guides/#wordpress`, `/services/care-plans/`, `/contact/`, `https://care.jkca.studio/score/`.
- Point to this page from: `/services/` index card, `/services/care-plans/` (one line), and a short note under /notes/ if json wants one later.

## 5. JSON-LD

Paste as one `<script type="application/ld+json">` block. The FAQ text below was generated from PAGE-COPY.md, with links and code formatting removed. If any FAQ wording changes on the page, regenerate this. Critic checks that they match.

Notes:
- `provider` points to the existing `https://jkca.studio/#org` LocalBusiness node already on the site (seen on /guides/). Don't create a second LocalBusiness.
- No `offers` with prices until json sets them. Once set, add `"price"` and `"priceCurrency":"USD"` to each Offer. Leave the free check at `"price":"0"` only if json keeps it free.
- Google shows FAQ rich results mostly for government and health sites now, so don't expect FAQ snippets in Google. The markup still helps AI search tools read the page. Keep it.
- Update `@id` and URLs if the slug changes.

```json
[
  {
    "@context": "https://schema.org",
    "@type": "Service",
    "@id": "https://jkca.studio/services/php-patch/#service",
    "name": "PHP patch help for the php2shell flaws",
    "serviceType": "Emergency PHP security patching and verification",
    "description": "JKCA Studio checks your PHP version, applies the fix for CVE-2026-109618 and CVE-2026-109619 (php2shell), restarts PHP, verifies the fixed version on the live site, and can look for signs of compromise or patch and upgrade sites on PHP 8.1 and older.",
    "url": "https://jkca.studio/services/php-patch/",
    "provider": {
      "@id": "https://jkca.studio/#org"
    },
    "areaServed": [
      {
        "@type": "City",
        "name": "Seal Beach, CA"
      },
      {
        "@type": "City",
        "name": "Long Beach, CA"
      },
      {
        "@type": "AdministrativeArea",
        "name": "Orange County, CA"
      },
      {
        "@type": "Country",
        "name": "United States"
      }
    ],
    "hasOfferCatalog": {
      "@type": "OfferCatalog",
      "name": "PHP patch help",
      "itemListElement": [
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Free PHP check"
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Patch and verify"
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Patch, verify and check for trouble"
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "PHP 8.1 or older: patch, then upgrade or move"
          }
        }
      ]
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "FAQPage",
    "@id": "https://jkca.studio/services/php-patch/#faq",
    "mainEntity": [
      {
        "@type": "Question",
        "name": "Is my WordPress site affected by the PHP vulnerability?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "It is if your server runs an unfixed PHP version. The flaw is in PHP, not in WordPress itself, so WordPress, Drupal and Joomla sites are exposed through the PHP underneath them. Check your PHP version in Tools → Site Health → Info → Server and compare it with the fixed versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On PHP 8.1, 8.0 or 7.4, the version number doesn't change after the official patch, so check that your PHP build is dated Oct 21, 2026 or later."
        }
      },
      {
        "@type": "Question",
        "name": "What is php2shell?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "php2shell is the nickname for two PHP flaws, CVE-2026-109618 and CVE-2026-109619, fixed on Oct 21, 2026. Both can let an attacker run code on a server without logging in. The official severity score is 9.2 (CVSS v4)."
        }
      },
      {
        "@type": "Question",
        "name": "How do I check my PHP version?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "On WordPress, go to Tools → Site Health → Info and open Server. In a hosting panel, look at the site's PHP settings. On your own server, run php -v, and also check the PHP version your web server uses (for example php-fpm), since it can differ."
        }
      },
      {
        "@type": "Question",
        "name": "Which PHP versions fix CVE-2026-109618 and CVE-2026-109619?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or anything later in those branches. For 8.1, 8.0 and 7.4, the PHP team released official minimal patches; the version number stays the same, so check that your PHP build is dated Oct 21, 2026 or later. PHP 7.3 and older have no official fix. If you use a Linux distribution's PHP package, check your vendor's security notice."
        }
      },
      {
        "@type": "Question",
        "name": "What is the php2shell fix?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Update PHP to a fixed version, then restart PHP so the old code stops running. PHP's team says updating is the only complete fix. A web firewall can help while you update, but it doesn't replace the patch."
        }
      },
      {
        "@type": "Question",
        "name": "Is the CVE-2026-109618 patch out?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Yes. PHP released fixes for CVE-2026-109618 and CVE-2026-109619 on Oct 21, 2026, around 6:30 AM PT. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For 8.1, 8.0 and 7.4, the PHP team released official minimal patches; the version number stays the same, so check that your PHP build is dated Oct 21, 2026 or later. See the PHP Foundation post and php.net."
        }
      },
      {
        "@type": "Question",
        "name": "My host says I'm patched. How do I verify?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Check the PHP version yourself in WordPress Site Health or your hosting panel. Then ask your host in writing which exact PHP version is live for your site and whether PHP has been restarted since the fix. If they use a vendor build, ask which security update it includes."
        }
      },
      {
        "@type": "Question",
        "name": "My PHP version number didn't change after updating. Am I still exposed?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Maybe not. Linux distributions such as Ubuntu, Debian and Red Hat sometimes add the fix to an older version number (a backport). On PHP 8.1, 8.0 and 7.4, patched builds keep the same number, so check the package build date instead: Oct 21, 2026 or later. Your vendor's security notice for CVE-2026-109618 and CVE-2026-109619 lists the package version that contains the fix."
        }
      },
      {
        "@type": "Question",
        "name": "PHP 8.1 end of life: what do I do?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "On Oct 21 the PHP team released official minimal patches for 8.1, 8.0 and 7.4, and hosts and package sources such as CloudLinux alt-php, Plesk and Ondřej Surý's packages ship them. The version number doesn't change, so check that the build is dated Oct 21, 2026 or later. These versions are still past end of life, so plan an upgrade to 8.2 or later, or a move off PHP. PHP 7.3 and older have no official fix; until they're upgraded, CISA advises taking the site offline or putting it behind a web firewall."
        }
      },
      {
        "@type": "Question",
        "name": "Is the PHP vulnerability score 10.0 or 9.2?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "PHP's own score is 9.2 (CVSS v4). NVD lists 9.8 using the older CVSS v3.1 scale. A 10.0 score circulated after an early leak on Oct 20, and PHP says that figure was wrong. Either way it's rated critical, so patching is the right step."
        }
      },
      {
        "@type": "Question",
        "name": "Is php2shell being exploited?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Amazon says attack attempts began Oct 17 and are now widespread, though it's unclear whether any succeeded. CISA had seen no exploitation when it published its alert, and Canada's Cyber Centre reported none. The picture is still changing, so check CISA's alert for updates."
        }
      },
      {
        "@type": "Question",
        "name": "Was my site hacked? What signs should I look for?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Look for new or changed PHP files in wp-content/uploads, must-use plugins or the main site folder; admin users you don't recognize; scheduled tasks you didn't create; and PHP starting programs like shells, curl or wget. These are signs, not proof. Have someone check before you assume the worst."
        }
      },
      {
        "@type": "Question",
        "name": "Do I need to take my site offline?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Only if you can't patch. CISA's Oct 21 alert, which doesn't mention the official 8.1, 8.0 and 7.4 patches, advises taking PHP-based systems offline if they can't be updated, or if they run PHP 8.1 or older. If a fixed version is available for your server, including the Oct 21 patched builds for 8.1, 8.0 and 7.4, updating and restarting PHP is the better path."
        }
      },
      {
        "@type": "Question",
        "name": "Does a web firewall or Cloudflare protect me?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "It helps but isn't a fix. Cloudflare said it added protections for sites it proxies, and a web firewall can block some attacks while you update. A WordPress security plugin's firewall, such as Wordfence, runs inside WordPress, after PHP has already read the request, so it can't stop these flaws. PHP's team says updating PHP is the only complete fix."
        }
      },
      {
        "@type": "Question",
        "name": "Do I need to restart anything after patching PHP?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Yes. PHP processes that keep running (php-fpm, Apache with mod_php, LiteSpeed's lsphp) keep the old code until they restart. Restart them after updating, then confirm the new version from the live site."
        }
      },
      {
        "@type": "Question",
        "name": "Should I change my passwords and keys?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "If your site was online on an unfixed version, it's a sensible step. Researchers at Wiz report the flaws can expose server memory, which can hold passwords and tokens. Consider changing WordPress salts, database passwords, API keys, and email and payment keys."
        }
      },
      {
        "@type": "Question",
        "name": "Are Drupal, Joomla and other PHP sites affected?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Yes, through PHP. The flaw is in PHP itself, so any site or app running an unfixed PHP version is exposed, whatever it's built with. The fix is the same: update PHP and restart it."
        }
      },
      {
        "@type": "Question",
        "name": "Can you promise my site is safe after this?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "No one can honestly promise that. What we can do is get a fixed PHP version live, confirm it from the site itself, look for signs of trouble, and tell you in writing what we checked and what we couldn't see."
        }
      },
      {
        "@type": "Question",
        "name": "Do you only help sites in Seal Beach?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "No. We're based in Seal Beach and work with businesses across Long Beach and Orange County, and we can patch sites hosted anywhere. Most of the work happens remotely."
        }
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "position": 1,
        "name": "JKCA Studio",
        "item": "https://jkca.studio/"
      },
      {
        "@type": "ListItem",
        "position": 2,
        "name": "Services",
        "item": "https://jkca.studio/services/"
      },
      {
        "@type": "ListItem",
        "position": 3,
        "name": "PHP patch help",
        "item": "https://jkca.studio/services/php-patch/"
      }
    ]
  }
]
```