Patch and verify your site for the October 2026 PHP flaws

JKCA Studio is a web and care studio in Seal Beach that patches websites for the October 2026 PHP flaws known as php2shell, then checks the fix from the live site.

We've sat inside SOC 2 audits for clients and helped them pass. It's slow, careful work, and it's the standard we patch to.

Patch check

$395, one site

We find the PHP version that's live. Where we have access, we patch it to a fixed release, restart PHP and confirm the fix from a live page. Where only your host can change PHP, we ask them in writing. Either way you get a short note of what we found and what we couldn't see. Nothing on your site changes until you've said yes.

Ask for the check
Checked within 2 business days of getting access.
Patched within 5 business days of a PHP security release, for sites on monthly patching.
Alerts answered the next business day.

If you need more

A check for trouble
A look for signs someone got in: new or changed PHP files, admin users you don't recognize, scheduled tasks you didn't set up. A sign is not proof; we confirm before we say anything is wrong. Quoted in writing.
PHP 8.1 or older
The minimal patch first, if one exists for your version, then a tested move to a supported PHP, or off PHP to a simple static site. Quoted in writing.

Is my site affected?

PHP 8.5
Fixed in 8.5.12 or later
PHP 8.4
Fixed in 8.4.27 or later
PHP 8.3
Fixed in 8.3.36 or later
PHP 8.2
Fixed in 8.2.35 or later
PHP 8.1, 8.0 and 7.4, past end of life
Needs a patched build from your host or package source, made on or after Oct 21, 2026. The version number stays the same.
PHP 7.3 and older
No official fix. Upgrade to 8.2 or later.

Where to find your PHP version.

Compare the number with the table above. On 8.1, 8.0 or 7.4 the number stays the same after the patch, so look for a build made on or after Oct 21, 2026.

WordPress
Tools → Site Health → Info, then open Server and read the PHP version.
Hosting panel
Most hosts show the PHP version on the site's settings or PHP page.
Your own server
Run php -v. Your web server may use a separate PHP process (php-fpm), so check that version too.
Distribution package
Your vendor's security notice for these two CVEs names the package version with the fix.
A managed host
Ask in writing: "Which PHP version is live for my site, and has PHP been restarted since the fix?"

What's not included.

  • Promises that a site can't be broken into. No one can honestly make one.
  • Fixes on your host's side that we can't reach. If only your host can change PHP, we ask them in writing and pass on their answer.
  • Malware removal beyond the first look for warning signs. If we find something, we stop, tell you, and quote the cleanup.
  • Sites on PHP 7.3 or older. There is no official fix to install, so the check has nothing to apply.

Ask for the patch check.

One site per form. We reply in writing, and nothing starts before you pay.

The usual questions.

Is my WordPress site affected by the PHP vulnerability?
It is if your server runs an unfixed PHP version. The flaw is in PHP, not in WordPress itself, so WordPress, Drupal and Joomla sites are exposed through the PHP underneath them. Check your PHP version in Tools → Site Health → Info → Server and compare it with the fixed versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On PHP 8.1, 8.0 or 7.4, the version number doesn't change after the patch, so check that your PHP build was made on or after Oct 21, 2026.
How do I check my PHP version?
On WordPress, go to Tools → Site Health → Info and open Server. In a hosting panel, look at the site's PHP settings. On your own server, run php -v, and also check the PHP version your web server uses (for example php-fpm), since it can differ.
Is php2shell being exploited?
Amazon says attack attempts began Oct 17 and are now broad, though it's unclear whether any succeeded. CISA had seen no exploitation when it published its alert, and Canada's Cyber Centre reported none. The picture is still changing, so check CISA's alert for updates.
Does a web firewall protect me?
It helps but isn't a fix. A web firewall in front of your site can block some attacks while you update. A firewall that runs inside your app, such as a WordPress security plugin's, may not stop these flaws, because Sophos reports one of them can be triggered before any application code runs. PHP's security team says updating PHP is the only complete fix.
PHP 8.1 end of life: what do I do?
The PHP security team published minimal patches for 8.1, 8.0 and 7.4, and some package sources, such as Ondřej Surý's, ship them. The version number doesn't change, so check that the build was made on or after Oct 21, 2026. They're still past end of life, so plan a move to 8.2 or later, or off PHP. PHP 7.3 and older have no official fix, and CISA advises taking those sites offline until they're upgraded.
What does the patch check include?
We find the PHP version that's live and patch it to a fixed release, or, if only your host can, ask them in writing. We restart PHP and confirm the fix from a live page, list the WordPress, plugin and theme updates waiting, and take one look through the logs we can reach for known warning signs. You get a short written note of what we found, what we changed and what we couldn't see.
What does it cost?
The patch check is $395, one time, for one site. Anything more, such as a check for signs someone got in or an upgrade off PHP 8.1, is quoted in writing before we start.
What if my host manages PHP?
Then only your host can change it, and the timing is theirs. Check the PHP version yourself in WordPress Site Health or your hosting panel. Then ask your host in writing which exact PHP version is live for your site and whether PHP has been restarted since the fix. If they use a vendor build, ask which security update it includes. On the patch check, we ask for you and pass on their dated answer.
More questions 13 more
What is php2shell?
php2shell is the nickname for two PHP flaws, CVE-2026-109618 and CVE-2026-109619, fixed on Oct 21, 2026. Both can let an attacker run code on a server without logging in. The official severity score is 9.2 (CVSS v4).
Which PHP versions fix CVE-2026-109618 and CVE-2026-109619?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or anything later in those branches. For 8.1, 8.0 and 7.4, the PHP security team published minimal patches; the version number stays the same, so check that your PHP build was made on or after Oct 21, 2026. PHP 7.3 and older have no official fix. If you use a Linux distribution's PHP package, check your vendor's security notice.
What is the php2shell fix?
Update PHP to a fixed version, then restart PHP so the old code stops running. PHP's security team says updating is the only complete fix. A web firewall can help while you update, but it doesn't replace the patch.
Is the CVE-2026-109618 patch out?
Yes. PHP released fixes for CVE-2026-109618 and CVE-2026-109619 on Oct 21, 2026. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For 8.1, 8.0 and 7.4, the PHP security team published minimal patches; the version number stays the same, so check that your PHP build was made on or after Oct 21, 2026.
My PHP version number didn't change after updating. Am I still exposed?
Maybe not. Linux distributions such as Ubuntu, Debian and Red Hat sometimes add the fix to an older version number (a backport). On PHP 8.1, 8.0 and 7.4, patched builds keep the same number, so check the package build date instead: on or after Oct 21, 2026. Your vendor's security notice for CVE-2026-109618 and CVE-2026-109619 lists the package version that contains the fix.
Is the PHP vulnerability score 10.0 or 9.2?
PHP's own score is 9.2 (CVSS v4). NVD lists 9.8 using the older CVSS v3.1 scale. A 10.0 score circulated after an early leak on Oct 20, and PHP says that figure was wrong. Either way it's rated critical, so patching is the right step.
Was my site hacked? What signs should I look for?
Look for new or changed PHP files in wp-content/uploads, must-use plugins or the main site folder; admin users you don't recognize; scheduled tasks you didn't create; and PHP starting programs like shells, curl or wget. These are signs, not proof. Have someone check before you decide anything.
Do I need to take my site offline?
Only if you can't patch. CISA's Oct 21 alert, which doesn't mention the 8.1, 8.0 and 7.4 patches, advises taking PHP-based systems offline if they can't be updated, or if they run PHP 8.1 or older. If a fixed version is available for your server, including the patched builds for 8.1, 8.0 and 7.4, updating and restarting PHP is the better path.
Do I need to restart anything after patching PHP?
Yes. PHP processes that keep running (php-fpm, Apache with mod_php, LiteSpeed's lsphp) keep the old code until they restart. Restart them after updating, then confirm the new version from the live site.
Should I change my passwords and keys?
If your site was online on an unfixed version, it's a sensible step. Researchers at Wiz report the flaws can expose server memory, which can hold passwords and tokens. Consider changing WordPress salts, database passwords, API keys, and email and payment keys.
Are Drupal, Joomla and other PHP sites affected?
Yes, through PHP. The flaw is in PHP itself, so any site or app running an unfixed PHP version is exposed, whatever it's built with. The fix is the same: update PHP and restart it.
Can you promise my site is safe after this?
No one can honestly promise that. What we can do is get a fixed PHP version live, or ask your host for it in writing, confirm it from the site itself, look for signs of trouble, and tell you in writing what we checked and what we couldn't see.
Do you only help sites in Seal Beach?
No. We're based in Seal Beach and we work on sites hosted anywhere. Most of the work happens remotely.
Sources, read Oct 22, 2026, 5 PM PT 11 links
php.net release notes
Fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, Oct 21, 2026.
PHP Foundation
Score 9.2; the leaked 10.0 was wrong.
PHP security team on oss-security
Updating is the only complete mitigation.
CISA alert
Offline advice; no exploitation seen at publication.
CISA Known Exploited Vulnerabilities
Neither CVE listed when checked.
Canada's Cyber Centre AL26-026
Version table; no active exploitation identified.
CERT-EU 2026-018
Minimal source patches for 7.4, 8.0 and 8.1.
Patch tracker
Which package sources ship the 8.1, 8.0 and 7.4 patches.
Amazon threat intelligence
Attempts from Oct 17; unclear whether any succeeded.
Wiz Research
Server memory can hold passwords and tokens.
Sophos advisory
In-app firewalls may not prevent exploitation.

Not sure where your site stands?

Send us the address and who hosts it. We'll tell you what we see, and only start once you've said yes.

Ask for the check