CISA
US Cybersecurity and Infrastructure Security Agency ·
Read the official advisory →“CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619.”
Critical PHP flaw — CVSS 9.2For any online
store or website running on PHP
PHP2Shell: is your PHP-powered store affected?
A critical PHP flaw, disclosed Oct 21, 2026. Find out in a free 30-second check — no login needed.
Independent official sources (we are not affiliated with these
organisations):
CISA alert (US)
CERT-EU 2026-018
Canadian Cyber Centre AL26-026
Google Cloud
AWS bulletin 2026-143
php.net
advisory
Official warnings · CVE-2026-109618 & CVE-2026-109619
What official security agencies are saying
Government security agencies, the PHP project and major cloud providers all rate this flaw as critical. Short quotes, word for word, with screenshots of each page.
CERT-EU
Cybersecurity Service for the EU institutions ·
“Both vulnerabilities can allow unauthenticated remote code execution.”
Read the official advisory →“CERT-EU advises organisations to patch affected assets immediately.”
Canadian Centre for Cyber Security
Government of Canada ·
“Internet-facing PHP servers and applications are at heightened risk.”
Read the official advisory →“Organizations should identify affected systems and apply the appropriate updates immediately.”
The PHP Project
Official php.net security advisory ·
“PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.”
Read the official advisory →“All PHP users are strongly encouraged to update immediately.”
NIST National Vulnerability Database
CVE-2026-109618 · CVSS 9.2 Critical ·
Read the official advisory →“Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).”
Google Cloud
Google Cloud security blog ·
Read the official advisory →“The PHP project is not releasing fixes for PHP 8.1 or earlier, which have reached end of life.”
Amazon Web Services
AWS security bulletin ·
Read the official advisory →“Two critical issues have been identified in PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) that can allow an unauthenticated actor to run code on affected systems.”
Independent sources — we are not affiliated with these organisations. Screenshots captured Oct 24, 2026; the official pages may since have been updated.
Am I affected?
Anyone on the internetNo login or password needed
sends a crafted web request
Your store’s PHP engineEvery PHP setup that serves web pages
runs the attacker’s code on your server
What that code could reach
- Customer details
- Checkout & payment pages
- Store admin
CVSS 9.2 · Critical
Unauthenticated remote code execution
Fix: move to the fixed PHP release
CISA had not observed successful exploitation as of its alert, but urges patching now. Sources above.
Your store or site runs on an engine called PHP — WooCommerce, Magento, PrestaShop, OpenCart, custom PHP and more. Your version decides the fix.
What PHP version does your store run? Not sure? Free check
Red — upgrade needed
PHP 8.1 or older. No simple patch — Safe PHP Upgrade: free review, fixed price.
Amber — quick patch
PHP 8.2–8.5 below those numbers. Patch & Verify: $100 per store.
Green — already fixed
PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer. Nothing to do.
Pricing
One flat price for the patch, held in secure escrow until you’re happy. We confirm which option fits before you pay anything.
Patch & Verify
From $100 Per website · Scope confirmed first
Review your PHP setup with our team, then agree the patching work your website needs.
- PHP version and hosting review
- Applicable PHP security updates
- Backup and rollback planning
- Checkout and key-page checks
- Short completion report
Free consultation · No payment to book.
Work via Upwork
From $100 Per website · Scope confirmed first
Prefer Upwork? Discuss your website with HestaBit and agree the project through our profile.
- Review our profile and work history
- Discuss your PHP requirements
- Agree scope before hiring
- Manage messages through Upwork
- Use an agreed Upwork contract
Project price and platform fees confirmed on Upwork
Safe PHP Upgrade
Custom quote Per website
Older PHP versions need a closer review. We assess compatibility and plan the right upgrade.
- Current PHP and platform review
- Plugin and theme compatibility
- Custom code impact assessment
- Staging and rollback planning
- Written upgrade scope and quote
Free consultation · Upgrade quoted separately
Patching eligibility depends on your hosting and application. Major upgrades and extensive code changes are quoted separately.
How we work — and keep your data safe
The same five steps for every job, so you always know who has access and what we touch.
-
Free check & written plan
We confirm your PHP version and send a short written plan. You approve the scope and price, then pay into escrow — not to us.
-
Temporary, limited access
You create a separate login just for us (hosting panel or SFTP) and can revoke it any time. We never ask for passwords by email. NDA on request.
-
Backup and staging copy first
We take a backup and, where needed, test on a staging copy on your own hosting. We only touch the PHP version, its settings and compatibility code — we don’t open, copy or export customer, order or payment data.
-
Go live together, with a rollback plan
At a low-traffic time you choose. If anything looks wrong, we roll back to the backup.
-
Verify & release
We re-test key pages and checkout and send a before/after report. You confirm, revoke our access and release the escrow.
Delivered by HestaBit
The engineering engine behind modern PHP commerce.
HestaBit is a PHP and e-commerce engineering partner helping brands and store owners ship stable systems, faster upgrades, and safer production builds. The work spans PHP hardening, platform upgrades, performance tuning, and custom e-commerce delivery for live business-critical storefronts.
Globally Recognized Standards
FAQ
Do you need access to my store?
Only temporary, limited access for the job you approve — usually a separate hosting-panel or SFTP login that you create and can revoke any time. We never ask for passwords by email.
Will you see or keep my customers’ data?
No. We only work on the PHP version, its settings and compatibility code. We don’t open, copy or export customer, order or payment data, and any staging copy stays on your own hosting. NDA on request.
My host manages PHP (SiteGround, Kinsta, WP Engine, Bluehost…). Do I still need this?
Maybe not. On many managed hosts the fix is a PHP version switch in your hosting panel, or the host applies it for you. We’ll tell you which applies for free — or do it for you. If your host blocks the update and we can’t patch, the escrow refunds you in full.
How does payment work? What if you can’t patch it?
You pay $100 into secure escrow when you book. You release it once you confirm your store is patched. If we can’t get your store onto the fixed PHP release — for example, your host blocks the update — the escrow refunds you in full. Stores on PHP 8.1 or older need a Safe PHP Upgrade instead; we quote that separately and you don’t pay the $100.
Will an update break my plugins or take my store down?
A patch within PHP 8.2–8.5 is usually low risk and needs no downtime, or a brief restart. Upgrades from older PHP are tested on a staging copy first and go live at a low-traffic time you choose, with a rollback plan.
Is the free check a security scan?
No. It only reads public server headers that your site shows every visitor. Many hosts hide the PHP version — that’s normal, and we can check properly for free.
What is PHP2Shell?
Two critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2), disclosed Oct 21, 2026. PHP is the engine behind WooCommerce, Magento, PrestaShop, OpenCart, custom PHP shops and many other websites. Official advisories are linked at the top of this page.