Two critical PHP flaws. We find them and fix them.
CVE-2026-109618 and CVE-2026-109619 let attackers run code on PHP servers without logging in. Public exploit code exists. We help businesses on any platform and any host upgrade, restart and harden PHP, either by guiding your team or by doing the work for you.
Is the PHP your site runs on affected?
Run php -v on the server. A patched version on disk only protects you after every PHP worker restarts. Distro packages can carry backported fixes under older version numbers, so we confirm against your vendor's changelog.
Fix plans for the software you run.
Every platform has its own upgrade blockers and its own requests that need protecting. Pick yours for the details.
WordPress & WooCommerce
Blogs, business sites and stores. The largest PHP install base, and much of it on old PHP.
See the fix plan →Drupal
Government, university and enterprise sites, including Drupal 7 sites stuck on end-of-life PHP.
See the fix plan →Laravel
Custom apps and SaaS products on Forge, Vapor, Docker, Kubernetes or bare VPS.
See the fix plan →Magento & Adobe Commerce
High-revenue stores where downtime is expensive and extensions hold back upgrades.
See the fix plan →Joomla
Organization and community sites, including Joomla 3 installs on old PHP.
See the fix plan →Virtualmin servers
Self-managed hosting servers running many domains, each with its own PHP version and FPM pool.
See the fix plan →cPanel & Plesk servers
Shared and reseller hosting with MultiPHP, EA-PHP, alt-php or Plesk PHP handlers.
See the fix plan →Moodle
School, university and corporate training platforms full of student data and file uploads.
See the fix plan →Nextcloud
Self-hosted file sync and collaboration, often exposed to the internet by design.
See the fix plan →PrestaShop
Online stores where old PrestaShop versions keep servers on end-of-life PHP.
See the fix plan →Any cloud, any VPS, any server.
The fix is the same everywhere: a patched PHP build, restarted workers and hardened settings. We work on VMs, containers, Kubernetes, serverless runtimes and control-panel hosting.
Pick how much you want us to do.
Exposure check
- Every PHP version and server you run, listed
- Clear verdict: exposed or not, and how urgent
- Written report with next steps
Fixed fee, credited toward remediation
Guided remediation
- Upgrade plan for your platform and hosting
- Temporary hardening while you wait
- Edge and WAF rules written for your routes
- We review your team's work and verify it
Hourly or fixed package
Full repair and upgrade
- Staging test, upgrade and rollback plan
- Patched PHP on every server and container
- All workers restarted and verified
- Hardening, monitoring and a closing report
Fixed quote per environment
Patch watch
- We track PHP and platform advisories
- Quarterly version and config checks
- Priority response for the next critical CVE
Monthly retainer
From first call to verified fix.
Authorize
You sign a short scope and authorization. We don't scan or touch any system without it.
Inventory
We record every PHP version, server, container and worker process in scope.
Plan
You get a fixed quote, a schedule and a rollback plan before any change.
Patch and restart
We upgrade PHP and restart every worker so no vulnerable code stays in memory.
Verify
We confirm the fix on every host and hand over a written report.
Don't restart the server yet.
If you see shells or tools like curl launched by PHP processes, PHPSESSID cookies longer than 256 bytes, or a spike in PHP worker crashes, contact us before you patch. Restarting wipes the memory evidence that shows what an attacker did. We preserve that evidence first, then work with an incident response firm if the investigation needs one.
Find out where you stand this week.
Tell us what you run and where it's hosted. We'll reply within one business day with a time for the exposure check.
Include your platform, approximate number of sites or servers, and your hosting provider.