Verify your exposure
For a working website whose PHP patch status is unclear.
- Check the PHP runtime serving your website
- Verify hosting or vendor patch evidence
- Receive findings and recommended next steps
PHP security response / WordPress & business websites
Critical PHP update.
Is your website patched?
We verify your hosting's PHP patch status, check for signs of compromise, and help restore affected WordPress websites.
Human review. Clear scope and quote before paid work begins.
Advisory checked 22 October 2026
PHP has released fixes for CVE-2026-109618 and CVE-2026-109619. A WordPress or plugin update alone does not patch the PHP runtime. A vulnerable installation is not proof of a breach. Read the official PHP advisory.
Choose your next step
Not sure, unpatched, or already hacked?
We establish what your site needs before recommending work. Shared hosting updates may need to be applied by your provider; we help coordinate and verify them.
Patch with confidence
For a site that needs an update without avoidable disruption.
- Agree a backup and rollback plan
- Coordinate PHP updates with your host
- Test forms, logins and checkout where applicable
Recover a hacked site
For redirects, suspicious accounts, malware or recurring infections.
- Preserve available evidence and assess scope
- Remove malware and investigate persistence
- Close identified entry points and verify recovery
Pricing depends on access, hosting, compatibility and incident scope. An assessment is not a full forensic investigation; agreed deliverables and limitations are documented.
For agencies & hosting resellers
One clear view across your client portfolio.
Get a prioritised PHP inventory, hosting coordination and a remediation plan across multiple sites. Confidential white-label support is available.
Discuss My Client PortfolioRelevant recovery experience
263 WordPress sites. One agency recovery.
See how WebAdish handled an agency portfolio with persistent backdoors. This is prior recovery experience, not a claim of PHP2Shell incident attribution.
Read the recovery case studyStart with your website
Tell us what needs checking.
Share your website URL, hosting provider and whether anything looks wrong. Don't know your PHP version? That's fine. Please don't send passwords through this form.
After the immediate work, we can discuss ongoing maintenance for updates, backups and monitoring.
Before you decide
Does a PHP update remove existing malware?
No. Updating addresses the runtime vulnerabilities. Existing malicious files, stolen credentials or persistence need separate investigation and recovery.
Can you confirm my exposure from just my website URL?
A URL helps start the assessment. Reliable patch verification usually needs hosting information or authorised access. Version banners alone can miss vendor backports.
Will a firewall or security plugin fix this?
Do not treat either as proof that PHP is patched. The PHP team says updates are the complete solution for these vulnerabilities; temporary mitigations only reduce specific attack paths.
Can you help if my host manages PHP?
Yes. We can request patch evidence, coordinate the host's update and test your site's key functions. Any access and paid work are agreed with you first.
Want the background? Read our PHP2Shell guide for website owners.