PHP2ShellAttacks began 17 Oct. Fixed builds shipped 21 Oct. Check your exposure
Pallaris

PHP2Shell · CVE-2026-109618 and CVE-2026-109619

Fix PHP2Shell. Then prove it’s fixed.

Rated 9.2 by the PHP team and 10.0 by watchTowr, with attacks reported before the patch existed. We upgrade or isolate the runtime, verify the build that’s actually running, check for earlier compromise, and hand you a dated record.

Check my exposure Book a fix

Any PHP stack, any host. WordPress, Laravel, Magento, Drupal, custom. Written permission first, backup before every change.

pallaris / case replay
PHP2Shell · 17–22 Oct

What was reported, in order

    Timeline: public reporting, linked on each line. The approval steps show how we work.

    0 Oct

    First reported exploitation attempt, four days before disclosure

    Amazon via BleepingComputer ↗
    0+ hours

    Cloudflare reportedly saw attacks before the patch landed

    Wikipedia summary ↗
    0.0M

    Instances flagged as potentially exposed

    Unit 42 ↗
    0 days

    Median to fully remediate edge-device flaws

    Verizon DBIR 2025 ↗

    Services

    Your site is how people find you. Here’s what we do when it’s at risk.

    Most of our clients run a clinic, a firm, a shop or an agency. They aren’t technical, and they shouldn’t need to be. Here’s what usually goes wrong, what we do about it, and exactly what lands in your hands.

    You were told it’s fixed. We make sure it is, on your actual site, and hand you the proof.

    What’s going on

    “We’ve handled it” isn’t something you can show anyone.

    • Your host’s email doesn’t say which version, when it was applied, or whether the server was restarted. Those are the three things a client or insurer will ask. U.S. Chamber guide ↗
    • A version number can look old and be patched, or look new and still be running the old code. Check guide ↗
    • Attacks started four days before the fix existed, so “we patched on Tuesday” isn’t the whole story. BleepingComputer ↗

    What we do

    1. 01Look at what your site actually runs, not what the invoice says
    2. 02Take a backup, then upgrade a copy first (8.5.12, 8.4.27, 8.3.36 or 8.2.35)
    3. 03If your app can’t take the upgrade today, put a temporary shield in front of it
    4. 04Restart, then confirm the version that’s really running
    5. 05Check for signs someone got in earlier
    6. 06Write it all down, with dates

    What you get

    • A site running a fixed version, confirmed
    • A way back if anything breaks
    • The result of the break-in check
    • A one-page record you can forward
    • A week of follow-up questions
    0.0

    severity out of 10 from the PHP team. watchTowr rated it 10.0.

    CISA alert

    Price

    $450

    per site

    Fix it for me See all pricing
    Inside Pallaris

    One advisory in.One dated record out.

    Hharbour-dental · php 8.2.31 · exposedLlindqvist-law · php 8.3.34 · awaiting approvalKkestrel-shop · php 8.4.27 · verifiedOoakline-books · php 7.4.33 · exposedMmeridian-accounts · php 8.5.12 · verifiedPALLARISEVIDENCE #412

    Advisory matching

    A new advisory is matched to every verified site by runtime, server and stack, so you see who is exposed in minutes.

    Evidence records

    Each approved change prints a dated record: found, approved, applied, verified. Forward it to an insurer, auditor or client.

    CloudflareHostsWordPressGitHubproposing · cloudflare

    Fits the stack you run

    Stage a firewall rule, read the host's PHP build, queue plugin updates, open a pull request. Each connection proposes. You approve.

    FIX APPLIEDfixed · score 12

    Exposure, measured

    Score exposure from the first check to the verified fix. Every drop is tied to an approved change.

    DAILY SNAPSHOTSMTWTFSSTEST COPYwaitingPick a snapshot, prove it restores

    Backups you’ve actually restored

    A backup you have never restored is a hope. Each quarter we restore one to a test copy and record that it worked.

    RENEWAL QUESTIONNAIRE · SAMPLECritical patch applied within 14 days#0412MFA on admin accountsattestedBackups restore-tested14 OctAudit trail for every change6 records

    Answers backed by evidence

    Questionnaire answers link to dated records, so “where is the audit trail?” has a one-click answer.

    Diagrams use sample data and example domains. The Console, advisory matching and integrations are on the roadmap; today the same work is delivered by hand.

    What we know, with dates

    Less guessing. More record.

    The facts that matter for a fix, each linked to where it came from. Where sources disagree, we say so.

    1. 17 Oct

      First reported attempt

      Amazon’s MadPot honeypot records an exploitation attempt, four days before disclosure.

      BleepingComputer

    2. 21 Oct, 07:43 UTC

      Cloudflare sees attacks

      Reported more than six hours before the patch landed.

      Wikipedia summary

    3. 21 Oct

      Fixed builds ship

      PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA issues an alert. watchTowr’s sensors catch attempts, none successful.

      CISA alert

    4. 21–22 Oct

      Hosts respond

      Hostinger fixed every plan except VPS. Automattic’s hosts were already protected.

      Hostinger

    5. 22 Oct

      KEV status

      Reports at the time said CISA had not listed either CVE in its Known Exploited Vulnerabilities catalog. Check the live catalog.

      Tanium timeline

    Where sources differ

    Severity

    9.2 (PHP team) versus 10.0 (watchTowr)

    Exploitation

    Attempts reported by Amazon, Cloudflare and watchTowr. watchTowr saw no successes. CISA had not confirmed at the time.

    Public exploits

    Rapid7: proofs of concept work only on specific OS, PHP and server combinations.

    Version checks

    Distribution builds and end-of-life backports keep the old number, so a version comparison can mislead in both directions.

    Exposure check

    Three answers. A verdict you can act on.

    No sign-up, and nothing leaves your browser. If there’s something you can’t answer, say so. We’ll show you the quickest way to find out, or do it for you.

    01What PHP version does your site run?
    02Who looks after the server?
    03Does the site hold customer data?

    The advisory · CVE-2026-109618, -109619

    Fixed builds
    8.5.12 · 8.4.27 · 8.3.36 · 8.2.35
    Backports
    7.4 to 8.1, minimal source only
    Reported affected
    5.4 to 8.5
    Highest risk
    Apache with mod_php

    Start with question 1. The verdict appears as you type, and gets sharper with each answer.

    How it stays safe

    Fixes that ask before they act.

    You choose how much runs on its own. Speed, control and cost pull against each other, so we make the trade-off visible and keep the final say with you.

    Look, never touch.

    Read-only analysis of domains you’ve proven you control. Nothing on the site changes, and findings stay in your account.

    Finds: PHP version behind the patched release.
    Never
    • Test a domain you haven’t proven you own or been authorised to test.
    • Change anything without a backup and a logged approval.
    • Promise a site can’t be hacked. We fix what we found and say what we didn’t cover.

    Policy as code

    Autonomy you can read, version and audit.

    One file states what Pallaris may observe, propose, apply, and never touch. It sits in your repository or ours, and a change to the policy is reviewed like any other change.

    “Observe is automatic. Anything that changes a live site is a proposal until a named person approves it.”

    Design rule

    Pallaris operating principle

    # pallaris.policy.yml
    domain: northwind-dental.example
    verified: dns-txt
     
    autonomy:
      observe:        automatic     # read-only, verified domains
      propose:        automatic     # diffs, tickets, host messages
      apply:          approval      # named approver, staged first
      active_testing: signed_scope  # never without paper
     
    approvers:
      - owner@northwind-dental.example
     
    guardrails:
      backup_before_change: required
      rollback_plan: required
      window: "Sun 02:00-04:00"
    Read the approval ladder

    Design preview with sample data. The policy file ships with the Console.

    Pricing

    What it costs, before we start.

    Prices are in US dollars, per site. Every job starts with a look at what you actually have and ends with a record of what changed. No surprises: you’ll know the cost before we start.

    Check

    Know where you stand.

    $150
    per site
    • Authorised exposure assessment
    • One-page report with severity and evidence
    • Prioritised remediation list
    • Delivered in 2 business days
    Book the check

    Quick Fix

    Most chosen

    Assess, then remediate.

    $450
    per site
    • Everything in Check
    • Backup, staged upgrade, production change
    • Compromise review included
    • Rollback plan and dated evidence record
    • 7 days of follow-up
    Fix it for me

    Full Package

    Remediated, cleaned and hardened.

    $1,500
    from, per site
    • Everything in Quick Fix
    • Malware cleanup if anything is found
    • Firewall, 2-step login, admin lockdown
    • Automated backups with a restore test
    • 30 days of monitoring and a review call
    Book the full package

    Care plan

    The next advisory, handled.

    $99
    per site, per month
    • Monthly re-check
    • Advisories matched to your stack, fix attached
    • Quarterly backup restore test
    • A written monthly summary
    Start a care plan

    Compromise review

    standalone, per site

    $250

    Evidence pack

    per site

    $295

    Scoped penetration test

    signed scope required

    Quoted

    Playbooks

    Do it yourself, properly.

    The working notes behind our service, free. Use them, or hand them to whoever runs your hosting.

    Advisory response · 4 min

    PHP2Shell: a 30-minute response plan for sites you don’t host

    Inventory, prioritise, get written confirmation from the host, verify. In that order.

    Read the playbook
    Host verification · 3 min

    What “we’ve patched it” should mean in writing

    A version number alone doesn’t prove a site is safe. Here’s what a defensible confirmation contains.

    Read the playbook
    Incident triage · 4 min

    Compromise indicators to check before and after a runtime patch

    The exposure window opens before disclosure. Patching closes the door; it doesn’t tell you who was inside.

    Read the playbook

    FAQ

    The questions that decide whether you buy.

    Close PHP2Shell this week.

    Twenty minutes. We’ll tell you whether the flaw affects your sites, what the fix involves, and what it costs.

    Start with the check See pricing

    Call booking opens shortly. The exposure check above is the fastest way to start.