PHP2Shell: is your PHP website exposed?

• The PHP security team disclosed CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"), both rated CVSS 9.2 (Critical).
• An attacker can take over a website remotely without logging in.
• Passwords and API keys can be read from server memory.
• Every PHP version from 5.4 is affected, so WordPress, Drupal, Joomla and Magento sites are all at risk.

Patched releases: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older no longer receive official fixes.

Find out which PHP version your website runs:

1. WordPress: go to Tools → Site Health → Info → Server and look for "PHP version".
2. cPanel or Plesk: open the PHP version / PHP settings page for your domain.
3. Not sure? Ask your hosting provider, or send us your website address and we will check for you.
4. PHP 8.2 or above: you need the latest patch in the same series (for example 8.3.x → 8.3.36). PHP 8.1 or 7.x: read the upgrade risk section below first.

From HK$99.9 per website

For websites already running PHP 8.2 or above. It includes:

• Checking which PHP version your site runs
• Updating to the patched release in the same series
• A basic check that your site runs normally afterwards

Not included in HK$99.9:

• Upgrading across versions (for example 7.x or 8.1 → 8.2+)
• Fixing plugin, theme or custom-code compatibility
• Malware removal or recovering a site that has already been compromised

Offer applies to direct clients, per website. Agencies and resellers: contact us for partner pricing.

Forcing an upgrade straight to PHP 8.2 or above is very likely to break older WordPress plugins, themes or custom code and take your site offline.

We first check compatibility in a test environment, then quote for the upgrade. This is not included in the HK$99.9 service.

Most websites fall into one of these situations. They are examples to help you see where your site fits, not a fixed price list.

Not sure which case is yours? Send us your website address and we will tell you.

Estimated starting prices per website, so you know what to expect before you contact us. Your final price is confirmed in the written quotation after inspection.

Add-ons, charged per item:

What are "overriding fixes"?

Many sites have changes written directly into a plugin, theme or Magento module, instead of a separate custom layer. Updating that plugin would erase the change, and the old code may not run on PHP 8.2+. We find these overrides, move or rewrite them so they survive future updates, and test them. This is the main reason older shops cost more to upgrade.

Example:

A WooCommerce shop on PHP 7.4 with 30 plugins, 2 of them with overriding fixes: est. HK$1,200 (~10 plugins) + 20 extra plugins × est. HK$150 + 2 overrides × est. HK$600 = est. HK$5,400.

Prices are per website, for direct clients, and exclude hosting fees, paid plugin or extension licences, and server migration. Magento 2 upgrades may also need a Magento version upgrade, which is assessed separately.

For anything outside the HK$99.9 service, we confirm the scope and price with you before any work starts.

Quotation steps:

1. Send us your site details using the checklist below. No passwords at this stage.
2. We review the information and what is visible from outside, and confirm which case applies.
3. We send a preliminary written quotation with the scope, price and estimated timeline.
4. Once you accept it, you grant us access securely (see "How we fix it").
5. We inspect the site in detail and reconfirm the final quotation before making any change.

What affects the price:

• How far your current PHP version is from 8.2 or above
• Platform, number of plugins or modules, and custom code
• Whether a test (staging) site already exists
• The access your hosting gives us (control panel, SSH)
• Signs of an earlier compromise that need clean-up
• Number of websites

Every quotation states:

• The exact work included and what is not included
• The price per website
• The estimated timeline and any planned downtime
• The backup and rollback plan before changes go live

Every job follows the same steps, so you always know what we are doing and nothing changes without your approval.

1. 1

   Secure access

   You create a separate, temporary account for us (hosting sub-account, SFTP or website admin) with only the permissions the job needs. Share the login by phone or a one-time secure link, never by email, DM or public comment. You can revoke it at any time.

2. 2

   Inspect (no changes)

   We check the PHP version, plugins or modules, custom code, error logs and any signs of compromise. Nothing on your site is changed at this stage.

3. 3

   Reconfirm the quotation

   We share what we found. If it differs from the preliminary quotation, we send a revised one, and no work continues until you approve it.

4. 4

   Back up

   We take a full backup of your files and database and keep it in your own hosting or server, so you can roll back if needed.

5. 5

   Test first

   For upgrades across PHP versions, we apply the changes on a test (staging) copy and check it before touching the live site.

6. 6

   Fix and patch

   We apply the PHP patch or upgrade and update incompatible plugins or code, at a time agreed with you to keep downtime low.

7. 7

   Verify

   We confirm the patched PHP version and test key pages, forms, admin login and, for shops, checkout.

8. 8

   Hand over and close access

   You receive a summary of every change. We remove our access, delete the login details you gave us, and recommend you change any passwords that were shared.

We need access to your server to fix it, not your customers' information. While we work on your site:

• We do not download, copy, export or keep your customers' data, such as customer records, orders or payment details.
• We only access what the job needs, and only for the agreed period.
• Backups stay in your own hosting or server; we do not take copies off your systems.
• We never ask for your customers' passwords or payment card details.
• We do not share or sell any information about your business or your customers.
• Every change we make is listed in the summary you receive.
• You can revoke our access at any time, and we remove it ourselves when the job ends.

Send us the following so we can confirm the scope and price:

1. Website address
2. Platform (WordPress, Magento, Drupal, Joomla or custom)
3. Current PHP version, if you know it
4. Hosting provider and control panel (for example cPanel or Plesk)
5. Any errors or unusual behaviour on the site right now
6. Whether you have a test (staging) site

Please do not send passwords, API keys or other credentials by email, public comments or a first DM. If access is needed, we will arrange a secure way to share it.

Patching closes the hole, but it cannot undo an attack that already happened. If your site may have been exposed:

• Change the passwords and API keys stored on the server (database, payment, email and admin accounts).
• Check for unknown admin users, new files or unexpected changes.
• Contact us; incident clean-up and recovery are quoted separately.