# PAGE-COPY · php2shell service page Drafted Thu Oct 22, 2026 (PT) for json's local Claude crew. Hand-off only: nothing is built, deployed, posted or set up in Stripe. Facts come only from `/workspace/jkca-stack/watch/CASCADE-CHECK-2026-10-22.md` (checked ~7:30 AM PT Oct 22). Tags like [F3] point to the fact list in `README.md`. Markup legend for the crew: `[PILL]` small all-caps label, `[BUTTON]` call to action, `[NOTE TO CREW]` not for the page. Anything in `{curly braces}` is a placeholder json must fill before launch. House rules: no em dashes, straight quotes, US spelling, only studio figure "about fifty live sites", no testimonials, no deal copy, no fear copy, no countdowns. Pills and buttons ALL CAPS, no "!", no prices. --- ## 0. Page meta (see KEYWORDS.md for the full set) - Proposed slug: `/services/php-patch/` - Title tag: `PHP Patch Help for php2shell (CVE-2026-109618) | JKCA Studio` - Show near the top, small: `Facts last checked {date and time, PT}. Sources linked below.` --- ## 1. Hero [PILL] PHP SECURITY FIX # Patch and verify your site for the October 2026 PHP flaws Two serious flaws in PHP, known as php2shell (CVE-2026-109618 and CVE-2026-109619), were fixed on Oct 21. If your website runs on PHP, as every WordPress site does, the fix is to get a patched PHP version live and confirm it. We can check your site, apply the patch, and show you it worked. [F1] [F4] [BUTTON] GET A FREE PHP CHECK → `/contact/?topic=php-patch` [BUTTON] CHECK IT YOURSELF → `#check-yourself` (anchor link) Small line under buttons: A small studio in Seal Beach. We look after about fifty live sites and we'll tell you plainly what we find. [NOTE TO CREW] No countdown, no red banners, no flashing. Calm hero, same style as the other /services/ pages. --- ## 2. What happened [PILL] WHAT IT IS ## What are the php2shell PHP flaws? On Oct 21, 2026, around 6:30 AM PT, the PHP project released fixes for two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619. Both can let someone run their own code on a server without logging in (remote code execution). The official severity score is 9.2 out of 10 (CVSS v4). A 10.0 score that went around online came from an early leak, and PHP says that number was wrong. [F1] [F2] [F4] Because the flaw is in PHP, not in WordPress, Drupal or Joomla, those sites are affected through the PHP version their server runs. Updating WordPress or your plugins does not fix it. Updating PHP does. [F5] Sources: [PHP Foundation](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/) · [php.net](https://www.php.net/) · [CISA alert](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) · [oss-security](https://www.openwall.com/lists/oss-security/2026/10/21/6) --- ## 3. Who is at risk [PILL] WHO IT AFFECTS ## Is my site affected? Your site needs attention if its server runs any of these: | PHP branch | Affected | Fixed in | |---|---|---| | 8.5 | below 8.5.12 | 8.5.12 or later | | 8.4 | below 8.4.27 | 8.4.27 or later | | 8.3 | below 8.3.36 | 8.3.36 or later | | 8.2 | below 8.2.35 | 8.2.35 or later | | 8.1, 8.0 and 7.4 (end of life) | builds made before Oct 21, 2026 | a patched build dated Oct 21, 2026 or later from your host or package source (the version number stays the same) | | 7.3 and older | yes | no official fix; upgrade to 8.2 or later | [F3] Version table also published by [Canada's Cyber Centre](https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619). A few setups need extra care: - **Shared or managed hosting.** Your host controls the PHP version. Reuters reported that small sites on shared hosting are among the most exposed, so it's worth getting a clear answer from your host. [F10] - **PHP 8.1, 8.0 or 7.4.** These are past end of life, but on Oct 21 the PHP team released official minimal patches for them. Hosts and package sources such as CloudLinux alt-php, Plesk and Ondřej Surý's packages (sury) ship them. `php -v` shows the same number before and after, so check the package build date instead: Oct 21, 2026 or later. These versions are still unsupported, so plan an upgrade to 8.2 or later. PHP 7.3 and older have no official fix. [F3] - **Linux distribution packages** (Ubuntu, Debian, Red Hat and similar). Vendors sometimes patch without changing the version number, so check their security notice rather than the number alone. [F9] --- ## 4. Check yourself in 2 minutes [PILL] CHECK YOURSELF ## How to check your PHP version Anchor: `id="check-yourself"` 1. **On WordPress:** log in, go to **Tools → Site Health → Info**, open **Server**, and read the PHP version. [F9] 2. **In your hosting panel:** most hosts show the PHP version on the site's settings or PHP page. 3. **On your own server:** run `php -v`. Your web server may use a separate PHP process (php-fpm), so check that version too. 4. **Compare** your number with the table above. 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later is fixed. On 8.1, 8.0 or 7.4 the number won't change, so check that the PHP package was built on Oct 21, 2026 or later (your host's notice or package changelog shows it). [F3] 5. **If you're on a distribution package**, look up your vendor's security notice for these two CVEs. [F9] 6. **If your host manages PHP**, ask in writing: "Which PHP version is live for my site, and has PHP been restarted since the fix?" [F11] [F12] If you're fixed, you're in good shape. If you're not sure, send us the site address and we'll look. [BUTTON] GET A FREE PHP CHECK → `/contact/?topic=php-patch` [OPTIONAL BLOCK, json to decide] A printable "Is my site patched?" checklist with these steps, the host questions, and the signs-of-trouble list. Price: {DECISION, json to set}. If json says no, cut this block. If yes, it sits on /guides/ with the others and this block links to `/guides/#php-patch`. Pill on the card: CHECKLIST (no price in the pill). --- ## 5. Service tiers [PILL] HOW WE HELP ## PHP patch help, in four sizes [NOTE TO CREW] Every price below is PROPOSED, json to set. Do not publish any figure until json confirms it. No checkout on this page: every tier goes to intake, then a written quote or invoice. Turnaround text is a placeholder too. ### Free PHP check Price: **Free** (PROPOSED, json to set) - You send the site address and who hosts it. - We look at what's visible from outside and tell you what to check and what to ask your host. - You get a short written answer: looks fixed, needs the patch, or needs a closer look. - Reply within {turnaround, json to set}. [BUTTON] GET A FREE PHP CHECK ### Patch and verify Price: **{$___ per site, PROPOSED, json to set}** - We update PHP to a fixed release, or confirm your vendor's patched build. - We restart PHP so the old code isn't still running. [F11] - We confirm the fixed version from the site itself, not just the control panel. - On shared or managed hosting, we work with your host and get the answer in writing. [F12] - You get a short written note of what we changed. [BUTTON] PATCH MY SITE ### Patch, verify and check for trouble Price: **{$___ per site, PROPOSED, json to set}** Everything in Patch and verify, plus: - We look for signs someone got in: new or changed PHP files in uploads, must-use plugins or the main folder; admin users you don't recognize; scheduled tasks you didn't set up; PHP starting programs it shouldn't. [F13] - We help you change passwords and keys that may have been exposed: WordPress salts, database passwords, API keys, email (SMTP) and payment keys. [F14] - You get a written report of what we checked, what we found, and what we couldn't see. - A sign is not proof. We confirm before we tell you anything is wrong. If we do find a problem, we explain it and quote the cleanup before doing it. Suggested when: your site was on an unfixed version after Oct 17, when attack attempts began. [F7] [BUTTON] CHECK MY SITE FOR TROUBLE ### PHP 8.1 or older: patch, then upgrade or move Price: **{from $___, PROPOSED, json to set; quoted after intake}** - On 8.1, 8.0 or 7.4, we first get the official minimal patch live (a build dated Oct 21, 2026 or later), restart PHP and confirm it. If your host controls PHP, we ask them in writing. [F3] - We test your site on a supported, fixed PHP version and fix the plugin or theme problems that come up. - If the site is better off without PHP, we can move it to a simple static site instead. See [WordPress migration](/services/wordpress-migration/) and the [Leave WordPress guide](/guides/#wordpress). - If no patched build is available for your version (for example PHP 7.3 or older), we help you follow CISA's advice until it's upgraded: take it offline or put it behind a web firewall. [F6] [F15] [BUTTON] PLAN MY UPGRADE After any tier: ongoing patching and checks are covered by our [security subscriptions]({/services/site-security/, slug json to set}). If you'd rather leave PHP behind, our [care plans](/services/care-plans/) host your site without it. [NOTE TO CREW] Changed Oct 22 PM: care plans host static sites with no PHP, so they are not where WordPress patching lives. See `/handoffs/security-subscriptions/`. --- ## 6. Process [PILL] HOW IT WORKS ## What happens after you get in touch 1. **Tell us about the site.** Address, host, and whether you can log in to the hosting account. 2. **We check and reply** with what we see and which tier fits, in writing. 3. **You approve the work.** We send a quote or invoice. Nothing starts until you say yes. 4. **We patch, restart and verify.** We confirm the fixed version from the live site. 5. **You get a written note** of what we did, what we checked, and anything still open. 6. **You remove our access** when we're done, or keep us on a security plan. --- ## 7. FAQ [PILL] QUESTIONS ## Common questions about the PHP flaws [NOTE TO CREW] Questions and answers here must match the FAQPage JSON-LD in KEYWORDS.md word for word. Use `
` or plain H3s; no hidden text beyond normal accordions. ### Is my WordPress site affected by the PHP vulnerability? It is if your server runs an unfixed PHP version. The flaw is in PHP, not in WordPress itself, so WordPress, Drupal and Joomla sites are exposed through the PHP underneath them. Check your PHP version in Tools → Site Health → Info → Server and compare it with the fixed versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On PHP 8.1, 8.0 or 7.4, the version number doesn't change after the official patch, so check that your PHP build is dated Oct 21, 2026 or later. ### What is php2shell? php2shell is the nickname for two PHP flaws, CVE-2026-109618 and CVE-2026-109619, fixed on Oct 21, 2026. Both can let an attacker run code on a server without logging in. The official severity score is 9.2 (CVSS v4). ### How do I check my PHP version? On WordPress, go to Tools → Site Health → Info and open Server. In a hosting panel, look at the site's PHP settings. On your own server, run `php -v`, and also check the PHP version your web server uses (for example php-fpm), since it can differ. ### Which PHP versions fix CVE-2026-109618 and CVE-2026-109619? PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or anything later in those branches. For 8.1, 8.0 and 7.4, the PHP team released official minimal patches; the version number stays the same, so check that your PHP build is dated Oct 21, 2026 or later. PHP 7.3 and older have no official fix. If you use a Linux distribution's PHP package, check your vendor's security notice. ### What is the php2shell fix? Update PHP to a fixed version, then restart PHP so the old code stops running. PHP's team says updating is the only complete fix. A web firewall can help while you update, but it doesn't replace the patch. ### Is the CVE-2026-109618 patch out? Yes. PHP released fixes for CVE-2026-109618 and CVE-2026-109619 on Oct 21, 2026, around 6:30 AM PT. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For 8.1, 8.0 and 7.4, the PHP team released official minimal patches; the version number stays the same, so check that your PHP build is dated Oct 21, 2026 or later. See the [PHP Foundation post](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/) and [php.net](https://www.php.net/). ### My host says I'm patched. How do I verify? Check the PHP version yourself in WordPress Site Health or your hosting panel. Then ask your host in writing which exact PHP version is live for your site and whether PHP has been restarted since the fix. If they use a vendor build, ask which security update it includes. ### My PHP version number didn't change after updating. Am I still exposed? Maybe not. Linux distributions such as Ubuntu, Debian and Red Hat sometimes add the fix to an older version number (a backport). On PHP 8.1, 8.0 and 7.4, patched builds keep the same number, so check the package build date instead: Oct 21, 2026 or later. Your vendor's security notice for CVE-2026-109618 and CVE-2026-109619 lists the package version that contains the fix. ### PHP 8.1 end of life: what do I do? On Oct 21 the PHP team released official minimal patches for 8.1, 8.0 and 7.4, and hosts and package sources such as CloudLinux alt-php, Plesk and Ondřej Surý's packages ship them. The version number doesn't change, so check that the build is dated Oct 21, 2026 or later. These versions are still past end of life, so plan an upgrade to 8.2 or later, or a move off PHP. PHP 7.3 and older have no official fix; until they're upgraded, CISA advises taking the site offline or putting it behind a web firewall. ### Is the PHP vulnerability score 10.0 or 9.2? PHP's own score is 9.2 (CVSS v4). NVD lists 9.8 using the older CVSS v3.1 scale. A 10.0 score circulated after an early leak on Oct 20, and PHP says that figure was wrong. Either way it's rated critical, so patching is the right step. ### Is php2shell being exploited? Amazon says attack attempts began Oct 17 and are now widespread, though it's unclear whether any succeeded. CISA had seen no exploitation when it published its alert, and Canada's Cyber Centre reported none. The picture is still changing, so check [CISA's alert](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) for updates. ### Was my site hacked? What signs should I look for? Look for new or changed PHP files in wp-content/uploads, must-use plugins or the main site folder; admin users you don't recognize; scheduled tasks you didn't create; and PHP starting programs like shells, curl or wget. These are signs, not proof. Have someone check before you assume the worst. ### Do I need to take my site offline? Only if you can't patch. CISA's Oct 21 alert, which doesn't mention the official 8.1, 8.0 and 7.4 patches, advises taking PHP-based systems offline if they can't be updated, or if they run PHP 8.1 or older. If a fixed version is available for your server, including the Oct 21 patched builds for 8.1, 8.0 and 7.4, updating and restarting PHP is the better path. ### Does a web firewall or Cloudflare protect me? It helps but isn't a fix. Cloudflare said it added protections for sites it proxies, and a web firewall can block some attacks while you update. A WordPress security plugin's firewall, such as Wordfence, runs inside WordPress, after PHP has already read the request, so it can't stop these flaws. PHP's team says updating PHP is the only complete fix. ### Do I need to restart anything after patching PHP? Yes. PHP processes that keep running (php-fpm, Apache with mod_php, LiteSpeed's lsphp) keep the old code until they restart. Restart them after updating, then confirm the new version from the live site. ### Should I change my passwords and keys? If your site was online on an unfixed version, it's a sensible step. Researchers at Wiz report the flaws can expose server memory, which can hold passwords and tokens. Consider changing WordPress salts, database passwords, API keys, and email and payment keys. ### Are Drupal, Joomla and other PHP sites affected? Yes, through PHP. The flaw is in PHP itself, so any site or app running an unfixed PHP version is exposed, whatever it's built with. The fix is the same: update PHP and restart it. ### Can you promise my site is safe after this? No one can honestly promise that. What we can do is get a fixed PHP version live, confirm it from the site itself, look for signs of trouble, and tell you in writing what we checked and what we couldn't see. ### Do you only help sites in Seal Beach? No. We're based in Seal Beach and work with businesses across Long Beach and Orange County, and we can patch sites hosted anywhere. Most of the work happens remotely. [NOTE TO CREW] 19 questions. If Critic trims, keep the first 9 and the "promise" question. --- ## 8. Closing CTA [PILL] NEXT STEP ## Not sure where your site stands? Send us the address and who hosts it. We'll check, tell you what we see, and only start work once you've said yes. [BUTTON] GET A FREE PHP CHECK → `/contact/?topic=php-patch` [BUTTON] TALK TO A HUMAN → `/contact/` Small line: Prefer to check it yourself first? Use the steps [above](#check-yourself), or get a [free site score](https://care.jkca.studio/score/). --- ## 9. Sources block (visible, bottom of page) Facts last checked {date and time, PT}. - PHP Foundation, Oct 21, 2026: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ - php.net release announcement: https://www.php.net/ - CISA alert, Oct 21, 2026: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching - CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog - Canadian Centre for Cyber Security AL26-026: https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619 - CERT-EU Advisory 2026-018: https://www.cert.europa.eu/publications/security-advisories/2026-018/ - oss-security (PHP security team): https://www.openwall.com/lists/oss-security/2026/10/21/6 - GitHub advisories (php/php-src): GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp - Amazon threat intelligence: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ - Wiz Research: https://www.wiz.io/blog/php2shell-php-rce - Plesk, EOL PHP builds dated Oct 21, 2026 (7.4.33, 8.0.30, 8.1.34): https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk (blocks curl with 403; opened in a reader Oct 22) - CloudLinux alt-php81 changelog (8.1.34-39, Oct 21, upstream 1d7dec17): https://changelog.cloudlinux.com/alt-php81 - Patch tracker (sury, Remi, Plesk, Zend LTS rows): https://ma.ttias.be/php-cve-2026-109618-patch/ - Sophos advisory: https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell - Sophos research blog, with its Oct 22 correction (no confirmed compromise): https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619