Find every runtime.
Identify PHP-FPM pools, Apache modules, containers, hosted panels, vendor builds, and forgotten deployments—not merely the CLI binary.
SECURITY RESPONSE / PHP2SHELL
Critical PHP vulnerabilities.
A practical response.
Two critical flaws in PHP can expose web-serving applications to unauthenticated remote code execution. We help smaller engineering teams and their service providers determine what is affected, apply the right fixes, and get back to a maintainable platform.
CVE-2026-109618 · CVE-2026-109619 · Advisory published October 21, 2026
What has your web host done about PHP2Shell? Compare 20 hosting providers by service type, patch status and who must act.
Find your hosting provider ↗START WITH EVIDENCE
Don't guess whether
you're protected.
A version string alone does not prove exposure or remediation. We trace the actual web-serving PHP runtime to its packages, image layers, vendor advisories, and deployment path.
Use an authoritative fix.
Apply upstream or supported vendor security releases, preserve a rollback path, and test application behavior before and after rollout.
Document the result.
Check exact package provenance and running services, capture evidence, and flag anything that requires a migration or deeper review.
HOW WE HELP
From urgent fix to
lasting improvement.
Engage for a focused first assessment or bring us into the delivery work. Every engagement is scoped and authorized before access is granted.
01 / ASSESS
PHP exposure assessment
Starting at $750
Read-only inventory, advisory and patch-state review, priority ranking, and a documented action plan.
Deliverable: findings and remediation roadmap
02 / REMEDIATE
Security patch & verification
Starting at $1,500
Coordinated backups, safe updates, compatibility checks, deployment, verification, and a tested rollback plan.
Deliverable: change record and validation evidence
03 / MODERNIZE
Legacy PHP modernization
Custom scoped proposal
Supported runtime upgrades, application compatibility work, containerization, test automation, and secure release pipelines.
Deliverable: maintainable supported platform
Prices shown are indicative starting points, not fixed quotes or emergency-response guarantees. Scope, urgency, number of systems, and vendor dependencies determine the final proposal. Ongoing maintenance plans are available by agreement.
WHO THIS IS FOR
Teams with PHP
in production.
We work with software agencies, managed-service providers, and businesses responsible for custom PHP applications or third-party applications that ship with PHP.
- Self-hosted applications using PHP-FPM or Apache/mod_php
- WordPress, Drupal, Joomla, Laravel and other PHP application stacks
- Hosting environments built on Plesk, cPanel or vendor-packaged PHP
- PHP running in containers, cloud VMs, or inherited infrastructure
- Legacy runtimes needing a security bridge and modernization plan
Product names indicate potential deployment patterns, not proof that any specific installation is vulnerable. Some vendors publish patched packages for unsupported PHP branches; verification must use the vendor's release documentation.
A CONTROLLED ENGAGEMENT
A clear path from concern to closure.
01
Authorize
Agree on systems, contacts, change windows, access boundaries, and success criteria.
02
Assess
Collect evidence from in-scope systems without exploitation or unsolicited scans.
03
Remediate
Apply appropriate supported updates with functional checks and rollback readiness.
04
Verify
Document package provenance, runtime state, outstanding risks, and next steps.
COMMON QUESTIONS
What you need
to know.
Does updating WordPress or another framework fix this?
Not by itself. These vulnerabilities affect the PHP runtime. Application updates can be valuable, but the runtime and its vendor-maintained package need specific verification.
My PHP version looks old. Is it definitely unpatched?
Not necessarily. Supported operating-system and commercial LTS providers sometimes backport the fix without changing the headline PHP version. The package build, vendor advisory, and running process must be checked together.
Can a firewall or WAF replace a PHP security update?
No. Temporary exposure-reduction measures may help while planning an update, but PHP's maintainers say upgrading to a patched build is the only complete solution for these flaws.
How do we start without sharing confidential details?
Send a short note describing your environment and approximate number of systems. Do not email passwords, production logs, sensitive configuration files, or customer data. Secure access is arranged after scope and authorization are agreed.
Official references and vendor guidance
Information reviewed October 23, 2026. Security advisories and patch availability evolve; always confirm the latest vendor guidance for each installation.
NEXT STEP
Let's establish what's affected—and what to do next.
Edgar Tech helps small teams make controlled, verifiable engineering changes. Start with a scoped PHP assessment.