# README · php2shell service page hand-off

Drafted Thu Oct 22, 2026, ~7:45 AM PT for json's local Claude crew. **Corrected Oct 22, ~3:00 PM PT: PHP 8.1, 8.0 and 7.4 do have official minimal patches. See `CHANGELOG.md`.** **Hand-off only.** Nothing has been built, deployed, posted, emailed, or set up in Stripe. The crew builds it; Critic gates it; json signs off.

Folder: `/workspace/jkca-stack/handoffs/php2shell-service-page/`

| File | What's in it |
|---|---|
| `PAGE-COPY.md` | Full page copy: hero, what it is, who's at risk, check yourself, 4 tiers (prices are placeholders), process, 19 FAQs, CTA, sources block |
| `KEYWORDS.md` | Keyword map (primary, secondary, long-tail, local, buzz phrases) by section, title tag, meta description, H1/H2 outline, slug, Service + FAQPage + BreadcrumbList JSON-LD |
| `AEO-SNIPPETS.md` | 18 direct answers, 50 to 55 words each, for AI search and featured snippets |
| `README.md` | This file: build list, Critic checks, json's decisions, fact sheet |

Proposed headline (H1): **Patch and verify your site for the October 2026 PHP flaws**
Proposed slug: **`/services/php-patch/`** (alternate `/php-patch/`)
Tiers: **Free PHP check · Patch and verify · Patch, verify and check for trouble · PHP 8.1 or older: patch, then upgrade or move**
Ongoing work after any tier: the new monthly security subscriptions in `../security-subscriptions/`.

---

## 1. What the crew builds

1. One new page at the slug json picks, using the existing `/services/` page template and styles (same header, footer, type, spacing as `/services/wordpress-migration/`).
2. Sections in the order of PAGE-COPY.md. The version table is a real HTML `<table>`, not an image.
3. Anchor `id="check-yourself"` on the self-check section.
4. FAQ as visible `<details>` accordions or H3s. Both are fine; no other hidden content.
5. One JSON-LD block from KEYWORDS.md §5. Prices stay out of it until json sets them.
6. CTAs go to `/contact/?topic=php-patch`. Add a "PHP patch" option (or read the `topic` param) on the contact form so these leads are tagged. **No checkout, no Stripe links on this page.** Tiers are sold by intake, then quote or invoice.
7. Visible "Facts last checked {date, time PT}" line near the top and in the sources block.
8. Links: add a card for this page on `/services/`, and one line on `/services/care-plans/`. Add the page to the sitemap.
9. Optional $9 checklist block: build it only if json says yes (see decision 4). If yes, it's a separate /guides/ card with its own Payment Link using the session-checked success URL from the Oct 20 guides audit.
10. Don't build: popups, countdowns, chat widgets, red alert bars, "spots left" counters, or a fake live-threat map.

## 2. What Critic must check

**Facts (block on any miss)**
- Every number and claim on the page matches the fact sheet below (§4), which comes only from `watch/CASCADE-CHECK-2026-10-22.md`. Nothing else is allowed in: no counts of hacked sites, no customer counts beyond "about fifty live sites", no host names singled out.
- Fixed versions read exactly 8.5.12, 8.4.27, 8.3.36, 8.2.35. CVE IDs read exactly CVE-2026-109618 and CVE-2026-109619. Score is 9.2 (CVSS v4); 10.0 appears only as the corrected leak.
- PHP 8.1/8.0/7.4 lines say "official minimal patch, same version number, build dated Oct 21, 2026 or later" everywhere (table, risk bullets, step 4, tier 4, three FAQs, AEO 3/6/9, JSON-LD). Nothing says "no fix" for 8.1 anymore.
- ⏱ **Re-check on launch day:** CISA KEV status (was not listed at 7:26 AM PT Oct 22; re-checked 2:43 PM PT, still not listed), exploitation status (Amazon vs CISA/Canada), and whether CISA's alert has been updated. Edit FAQ "Is php2shell being exploited?", AEO snippet 11 and the JSON-LD together if anything changed.
- The page never says or implies a specific site is compromised. "Signs, not proof" lines are present in Tier 3, the hacked-signs FAQ, and AEO snippet 12.

**Copy rules**
- Calm voice: no fear or scare words ("act now", "before it's too late", "under attack", "zero-day", "the internet is on fire"), no fake urgency, no countdowns.
- No guarantees: grep for "100%", "guarantee", "fully secure", "bulletproof", "hack-proof". The only allowed mention is the FAQ that says no one can honestly promise it.
- No deal copy: grep for "instead of", "save", "saving", "cheaper", "discount", "% off", "limited".
- Pills and buttons ALL CAPS, no "!", no prices, no vendor names.
- Never "squad". No em dashes (grep for U+2014), straight quotes only, US spelling.
- All tier prices still show as placeholders or json's confirmed figures. Nothing marked "PROPOSED" goes live.

**SEO / markup**
- One H1. H2/H3 outline matches KEYWORDS.md §2.
- FAQPage JSON-LD questions and answers match the visible FAQ word for word (links and code formatting removed). Validate with the Schema.org validator and Google's Rich Results Test.
- `provider` uses the existing `https://jkca.studio/#org`; no second LocalBusiness node.
- Title ≤ 60 characters, meta description ≤ 160, canonical correct.
- No keyword stuffing: each keyword in KEYWORDS.md appears where it answers a question, not in lists, footers, alt text dumps, or hidden elements.
- Curl every outbound link for a 200 (CISA, PHP Foundation, php.net, Cyber Centre, CERT-EU, oss-security, AWS, Wiz). The GHSA IDs are listed as text; if linked, use `https://github.com/php/php-src/security/advisories/<ID>` and confirm each returns 200 first. Some sites block bots (403); note those as snapshot-only, don't drop the citation.
- Internal links resolve: `/contact/`, `/services/wordpress-migration/`, `/services/care-plans/`, `/guides/#wordpress`, `https://care.jkca.studio/score/`. (Note: `jkca.studio/score/` returns 404; the free score lives at `care.jkca.studio/score/`.)

**Accessibility**
- Table has headers, buttons are real links with clear text, contrast passes, and the ⏱ marker is not shipped to the live page.

## 3. What json must decide

1. **Prices for each tier.** Starting points to react to (PROPOSED, json to set; based only on existing JKCA price points, no market research done): Free PHP check free; Patch and verify ~$149 per site; Patch, verify and check for trouble ~$395 per site; PHP 8.1 upgrade or move from $750 (same floor as the Squarespace move), quoted after intake. Also decide whether cleanup after a confirmed compromise is quoted separately (the copy currently says it is).
2. **Slug.** `/services/php-patch/` (fits the live services pattern) or `/php-patch/` (shorter, easier to say out loud).
3. **Turnaround promise.** The copy has `{turnaround, json to set}` for the free check reply and no promise for the paid tiers. Pick something you can keep with about fifty sites of your own to patch too (e.g. "reply within one business day"), or leave turnaround out entirely.
4. **The "Is my site patched?" checklist ({price DECISION, json to set}).** Sell it on /guides/ and link from the page, bundle it free with the free check, add it to the $99 bundle, or skip it. The page works without it.
5. **Scope limits and access.** Whether you'll take sites on hosts where you can't control PHP (you'd only verify and chase the host), how many outside sites you'll take this week alongside your own clients, and how clients give access (the copy promises only that they can remove access when done).

## 4. Fact sheet (from CASCADE-CHECK-2026-10-22.md only)

| ID | Fact | Source |
|---|---|---|
| F1 | CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state / use-after-free), nicknamed php2shell / PHP2Shell. Unauthenticated RCE in PHP itself. | PHP Foundation, oss-security, CISA |
| F2 | Official score CVSS v4 9.2. The 10.0 figure came from an Oct 20 leak; PHP says it was wrong. | PHP Foundation |
| F3 | Affected: 8.2 < 8.2.35, 8.3 < 8.3.36, 8.4 < 8.4.27, 8.5 < 8.5.12. **Corrected Oct 22 PM:** the PHP security team published official source-only "minimal mitigation" patches for EOL 8.1 (`1d7dec178a`), 8.0 (`82f8f31b16`) and 7.4 (`712e60f9ed`); they also turn off session upload progress. No new version numbers: CloudLinux alt-php (alt-php81 8.1.34-39, Oct 21), Plesk (7.4.33, 8.0.30, 8.1.34 "built on 21 Oct 2026"), sury/Ondřej's PPA, Remi, cPanel EA4 and Zend LTS ship them. `php -v` doesn't change, so check the package build date (Oct 21, 2026 or later) or changelog. 7.3 and older: no official patch (community ports only). Still EOL: plan 8.2+. Wiz: nearly every version back to 5.4 affected by at least one issue. | PHP, Cyber Centre, Wiz, Plesk, CloudLinux, cPanel, ma.ttias.be tracker, Sophos |
| F4 | Patch released Oct 21 around 6:30 AM PT (13:30 UTC per CERT-EU). | PHP Foundation, CERT-EU |
| F5 | Flaw is in PHP, so WordPress, Drupal and Joomla are exposed through PHP, not their own code. | Cascade check claim 1 |
| F6 | CISA (Oct 21 alert, which doesn't mention the official 8.1/8.0/7.4 patches): orgs that can't patch, or run PHP ≤ 8.1, should take PHP-based systems offline. NSA, FBI and CISA jointly urged the same. No CISA Emergency Directive. | CISA alert, Nextgov |
| F7 | Amazon (Oct 22): attempts began Oct 17, "now being broadly exploited in the wild", "unclear if any of these attempts would have succeeded". Cloudflare's CTO reported "early attacks". | AWS, BleepingComputer |
| F8 | CISA observed no exploitation at publication; Canada's Cyber Centre saw "no active exploitation". Not on CISA KEV as of 7:26 AM PT Oct 22. ⏱ | CISA, Cyber Centre |
| F9 | Check `php -v` or WP Site Health (Tools → Site Health → Info → Server). Distro packages may backport without a version bump; check the vendor notice. | Cascade checklist 1 |
| F10 | Small shared-hosted sites are the highest-risk group. | Reuters |
| F11 | Restart PHP after patching (php-fpm, Apache mod_php, LiteSpeed lsphp); long-lived workers keep old code. mod_php is the highest-risk setup. | Cascade checklist 2 |
| F12 | On shared or managed hosting, get written confirmation from the host that patched PHP is live. | Cascade checklist 3 |
| F13 | Compromise signs: PHP workers spawning shells or curl/wget; new or modified .php files in wp-content/uploads, mu-plugins or web root; unknown admin users; unexpected cron entries. | Cascade checklist 6 |
| F14 | Consider rotating WP salts, DB passwords, API keys, SMTP and payment keys on sites that were unpatched and internet-facing. Wiz: flaws can expose server memory (credentials, tokens). | Cascade checklist 7, Wiz |
| F15 | WAF helps but is not a fix; Cloudflare deployed protections for proxied sites. PHP team: updating is the only complete mitigation. | Cascade checklist 5 |
| F16 | JKCA: Seal Beach web studio, about fifty live sites (house figure). | json brief, house rules |
| F17 | Wordfence: its firewall runs inside WordPress (application layer) and it announced no firewall rule for these CVEs (secondhand: do not quote Wordfence on the page; paraphrase only). Sophos: in-process protections may not prevent exploitation because on mod_php the bug triggers before app code runs. | php2shellcheck.com vendor table (Wordfence post itself blocks our fetcher), Sophos advisory |
| F18 | Scores: PHP (CNA) CVSS v4 9.2; NVD CVSS v3.1 9.8. Neither is the leaked 10.0. | Sophos, Plesk, Rescana, ScanTitan |
| F19 | Sophos (Oct 22, 21:21 UTC = 2:21 PM PT) **retracted** its earlier "one successful exploitation" claim: telemetry shows scanning and a few failed attempts, no evidence of successful compromise; the Mirai-variant ("Potassium") payload was not delivered. Indicators it published remain useful to hunt: `/tmp/nfs`, `./nfs php`, UA `php2shell-scan/109618`, boundary `B7kQpoc618`. Do not write "Sophos confirmed an exploit". | Sophos blog |
| F20 | CISA KEV: still NOT listed at 2:43 PM PT Oct 22 (CSV last-modified Oct 21, 7:04 AM PT). ⏱ | CISA KEV CSV |

Caveats carried over from the cascade check: exploitation status is still moving; the AWS blog, SecurityWeek, Wiz and php.net details came from search excerpts and press write-ups, not direct reads. Critic should open those four pages before launch.

Not used on purpose: the Censys host counts, the list of government sites taken offline abroad, and the ~900 US government Shodan results. They're accurate to the cascade check but read as scare copy on a sales page.