Phoenix - Your AI AssistantUrgent PHP Security Update & Vulnerability Fix (PHP2Shell)
Delivery in
1 day
- Views 5
Amount of days required to complete work for this Offer as set by the freelancer.
Rating of the Offer as calculated from other buyers' reviews.
Average time for the freelancer to first reply on the workstream after purchase or contact on this Offer.
What you get with this Offer
On 21 October 2026, PHP released emergency fixes for two critical flaws in PHP itself, now known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619, rated 9.2). They allow an attacker to run code on your server without logging in. Details leaked before the fix was released and active exploitation attempts are already being reported.
Every PHP version from 5.4 to 8.5.11 is affected. That includes WordPress, WooCommerce, Drupal, Joomla, Magento and any custom PHP site. Updating plugins or WordPress alone does not fix it: the fix is at server level, in the PHP version your hosting runs.
I'm a software engineer and since the advisory came out I've already patched more than a dozen websites, for clients and for my own projects.
What I'll do on your website:
Take a full backup before touching anything
Check the exact PHP version your site runs and move it to a patched release (8.2.35, 8.3.36, 8.4.27, 8.5.12 or later) from your hosting panel
Confirm whether your host has applied server-level protection and that it's actually active on your plan
Apply the recommended temporary mitigation where needed
Update WordPress core (or your CMS) to the latest secure version
Test the site after the changes so everything works as before
Send you a short report with what I found and what I changed
Works with SiteGround, Hostinger, GoDaddy, Bluehost, IONOS, cPanel, Plesk and most shared, managed and VPS hosting.
If your site runs PHP 7.x, 8.0 or 8.1, those versions will not receive a patch and need upgrading to a supported branch. Check the extras below.
Don't wait on this one. Get in touch and I'll start today.
Every PHP version from 5.4 to 8.5.11 is affected. That includes WordPress, WooCommerce, Drupal, Joomla, Magento and any custom PHP site. Updating plugins or WordPress alone does not fix it: the fix is at server level, in the PHP version your hosting runs.
I'm a software engineer and since the advisory came out I've already patched more than a dozen websites, for clients and for my own projects.
What I'll do on your website:
Take a full backup before touching anything
Check the exact PHP version your site runs and move it to a patched release (8.2.35, 8.3.36, 8.4.27, 8.5.12 or later) from your hosting panel
Confirm whether your host has applied server-level protection and that it's actually active on your plan
Apply the recommended temporary mitigation where needed
Update WordPress core (or your CMS) to the latest secure version
Test the site after the changes so everything works as before
Send you a short report with what I found and what I changed
Works with SiteGround, Hostinger, GoDaddy, Bluehost, IONOS, cPanel, Plesk and most shared, managed and VPS hosting.
If your site runs PHP 7.x, 8.0 or 8.1, those versions will not receive a patch and need upgrading to a supported branch. Check the extras below.
Don't wait on this one. Get in touch and I'll start today.
What the Freelancer needs to start the work
What I need from the buyer
Your website URL(s)
Access to your hosting account (collaborator access if your host offers it, or login details)
WordPress admin access, if it's a WordPress site
Your availability for two-step verification codes, if your account uses them