PHP Patch Assurance

Verified, reversible PHP patching — with a work report you can hand to your boss, your insurer, or a compliance file.

Watch how it works — the explainer

How it works

1. Detect. Free external scan now; a read-only deep check on your server for a certain answer (most sites hide their PHP version — we verify you own the site first, then show you the exact plan).
2. Snapshot. Before anything changes, we snapshot your runtime and restore-test the snapshot. If the safety net doesn't work, we don't touch your site.
3. Patch. One click, with the old version kept serving until the patched build is verified. If our checks fail afterwards, the patch reverts automatically — free on every paid tier.
4. Verify & report. Post-patch verification, then a PDF work report with an executive summary, the full audit trail, and a SHA-256 integrity hash.
5. Rollback. Changed your mind days later? One-click rollback to the exact pre-patch state, verified against the pre-patch baseline.

Patched releases for php2shell

Pricing

The $49 tier's rollback lock is shown here and again in the plan you approve before we patch — an upgrade, never a surprise. And the guarantee: if a patch cannot be completed, or we cannot restore your pre-patch state, you pay nothing — a 100% refund. Recurring protection (we watch every PHP security release and re-patch on approval; multi-URL smoke tests and soak monitoring arrive with it): $299/year for Patch customers, $399/year for Patch + Rollback customers. Launches soon.

Governments are sounding the alarm

• United States — CISA: “CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP… known as 'php2shell'.” www.cisa.gov
• European Union — CERT-EU: “CERT-EU advises organisations to patch affected assets immediately. Where that is not feasible, organisations should consider isolating internet-facing applications until a fix is applied and verified.” cert.europa.eu
• United Kingdom — NCSC: “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.” www.ncsc.gov.uk
• Australia — ASD's ACSC: Advisory “Critical vulnerabilities in PHP” — identify affected systems and prepare to patch. www.cyber.gov.au
• France — CERT-FR (ANSSI): “CERT-FR recommends taking affected servers offline, where possible, until the update is applied.” cert.cyber.gouv.fr
• Netherlands — NCSC: “Serious vulnerabilities in PHP — prepare to patch.” The NCSC's own website was taken offline as a precaution. www.rijksoverheid.nl

Government statements above are quoted from, or translated from, the linked official sources — last verified Oct 22, 2026. The agencies named are cited as sources only; they do not endorse phpatch.com.

Proof: a real site, the night the fixes shipped

mitbbs.ai, a bilingual news portal based in New York, USA, a production forum on PHP 8.3.35 under Apache mod_php — the highest-risk configuration — was patched to 8.3.36 the evening of Oct 21 with ~10 seconds of interruption, verified live, with a full work report. The same playbook, automated, is what you are buying.

Cybersecurity alerts by email

Free newsletter: PHP security releases, critical CVE alerts and patching guidance. No spam, unsubscribe anytime.

Frequently asked questions

What does the free scan check?

It reads only what your site discloses publicly — passive fingerprinting plus limited, read-only checks of a few well-known paths, such as an exposed phpinfo page — and compares the disclosed PHP version against the fixed releases: 8.2.35, 8.3.36, 8.4.27 and 8.5.12 for php2shell. It runs no exploit probes, ever.

What is php2shell?

php2shell is the name given to two critical flaws in PHP core, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), which allow unauthenticated remote code execution. Details leaked on Oct 20, 2026, attacks began Oct 21, and fixed PHP releases shipped the same day.

Which PHP versions are vulnerable to php2shell?

PHP below 8.2.35 (branch 8.2), 8.3.36 (8.3), 8.4.27 (8.4) and 8.5.12 (8.5). Branches older than 8.2 are end-of-life: no upstream fix exists, so the branch itself must be upgraded.

My scan says the version is hidden. Am I safe?

Not necessarily — most well-run sites hide their PHP version, so an external scan honestly reports the status as indeterminate. The read-only deep check runs on your server (after you prove ownership) and gives a definitive verdict for every PHP runtime installed, including Docker containers.

How much does patching cost?

The scan is free. A verified patch is $49 per server runtime; patch + rollback is $99. If we cannot complete and verify the patch, or cannot restore the pre-patch state, the fee is refunded in full. Recurring Patch ($299/yr) and Patch + Rollback ($399/yr) plans launch soon.

Do you need root access to my website?

We never ask for your root login, your hosting-panel login, or a CMS admin password. The free scan needs no access at all: it is external only. The deep check asks for a temporary, read-only SSH login, and only after you prove ownership (a DNS TXT record or a small file placed on the site); it runs a fixed command list — PHP version, package list, PHP config — changes nothing, and you revoke it when the check is done. The patch itself needs a dedicated account on your Docker host that can run Docker — be clear-eyed: an account that can run Docker is equivalent to root on that host, so create it for us alone. We generate a key pair for your order and you add the public key to that account; you never send us a password or a private key, our private half is destroyed when the job completes, and you delete the account when your work report is delivered.

What happens after I pay?

You schedule it yourself, right on the confirmation page — there is no email round-trip. You pick the window (as soon as possible, or a date and time window in your timezone), prove you own the site (a DNS TXT record or a small file), and add our public key to a temporary account on your Docker host. If you don't have them handy, create a free account and finish the setup there anytime; the order attaches to your account automatically. Paying does not run anything on your server: the patch is a supervised job that runs inside your window, on the exact plan you approved — a backup and snapshot are taken first, the patched build is verified before it takes traffic, a failed health check rolls it back automatically, and the job ends with a work report carrying a SHA-256 integrity hash. If the patch cannot be completed and verified, the fee is refunded in full.

What happens if a patch breaks my site?

Before anything changes, we snapshot the runtime and restore-test the snapshot; if it cannot be proven good, the patch does not run. The patched build is verified before it takes traffic, and a failed health check reverts the change automatically, free. Every job ends with a work report carrying a SHA-256 integrity hash.

My PHP is older than 8.2. What are my options?

Branches below 8.2 are end-of-life and have no upstream fix. For Docker hosts we offer a one-click branch upgrade to the next supported branch, with the same snapshot, verify and rollback gates, and the compatibility risk stated up front. A mitigation stopgap is available while you plan the upgrade.

Is the scanner open source?

Yes. phpscan — the exact code that runs the scan on this site — is MIT-licensed at github.com/PHPatch/phpscan, and also available as a zip download. The patching engine is not open source.

Security & disclosure · Terms · Privacy · DPA · About · Open-source scanner on GitHub

Threats — PHP vulnerability advisories · Compare PHP vulnerability scanners · Automated Security Assessment

Superstar Telecom LLC, a New York technology company that operates multiple websites and products, Found on 08/2014.

Your data stays yours: backups are retained only for the window above and deleted on request.

Not affiliated with the PHP Group. PHP is a trademark of the PHP Group.