PHP2Shell or a broken WordPress site?From diagnosis to a working website.
PHP2Shell refers to critical vulnerabilities CVE-2026-109618 and CVE-2026-109619. PHP released fixes on 21 October 2026. If you run WordPress or another PHP application, check the PHP runtime at your host; updating plugins alone is not enough. PHP.net ↗
Start with the facts.
Check public PHP and WordPress signals. Or compare the runtime version confirmed by your host.
Enter a public address without secrets. We do not save results to a database; hashed IP and domain identifiers are used for rate limits. Your host sees an ordinary visit. Privacy policy.
Who can help with PHP2Shell in Slovenia?
Flisko helps businesses and web agencies assess PHP2Shell, update PHP, repair WordPress after PHP upgrades and migrate WordPress, WooCommerce or PHP applications to a maintained environment. We start with the actual PHP runtime and application compatibility. Scope, price and scheduling are agreed before implementation.
WordPress broken after a PHP upgrade?
Your host changed PHP and the site now shows an error or stops taking orders. Older themes, plugins, custom PHP code or configuration may be responsible. We identify what broke, then agree the smallest useful intervention.
- HTTP 500
- Blank page
- Fatal error
- Broken forms
- WooCommerce checkout failures
We offer log review, staging reproduction, repair or replacement of incompatible components, and checks of login, forms and checkout. If the existing system cannot be maintained sensibly, we plan a migration. A complete rebuild is not the default answer.
Rolling back to PHP without a confirmed fix for both CVEs is not remediation. Any temporary rollback should be agreed with the host on a verified patched runtime.
From an unknown version to a verified update.
The first goal is remediation. We recommend migration when the current host or application prevents a maintained, verifiable solution.
PHP2Shell assessment
Inventory web PHP runtimes, verify packages against both CVEs and prioritise next steps. Receive findings with evidence and a scope for the work ahead.
Request an urgent assessment →PHP & WordPress upgrade
Backup, theme and plugin compatibility checks, PHP update, and agreed checks of forms, login and WooCommerce checkout.
Request an urgent assessment →Hosting migration
Move WordPress or a PHP application to a maintained environment. Plan data, DNS, TLS, redirects, cutover timing and rollback.
Request an urgent assessment →Which PHP versions contain the fixes?
These are the first fixed releases. Use the current security release in a supported branch; this table is not a recommendation to freeze on these versions indefinitely.
| PHP branch | First fixed release | Next step |
|---|---|---|
| 8.2 | 8.2.35 ↗ | Update and verify the running web PHP runtime |
| 8.3 | 8.3.36 ↗ | Update and verify the running web PHP runtime |
| 8.4 | 8.4.27 ↗ | Update and verify the running web PHP runtime |
| 8.5 | 8.5.12 ↗ | Update and verify the running web PHP runtime |
| PHP 8.1 and older | Outside regular upstream support | Verify a vendor fix or plan an upgrade |
A hosting provider or Linux distributor may backport the fixes into an older package. Ask for the package identifier and confirmation for both CVEs. HTTP headers and php -v may describe a different runtime from the one serving your website.
What do we need to get started?
Send the URL and hosting provider
Include your PHP version if known, application type and what is happening. Keep passwords and access keys out of the form.
Agree scope and access
We confirm authorisation, priorities, price and scheduling. Any hosting access is arranged through a secure handover.
Implement and verify
After the agreed work, we verify the running PHP environment and key functions. You receive the results and follow-up actions.
PHP2Shell: questions before making changes
Does updating WordPress fix PHP2Shell?
Updating WordPress, a theme or plugins does not itself update the PHP runtime on your server. Your hosting provider must confirm the fixed PHP version or vendor package serving web requests. WordPress and its extensions also need compatibility checks for the update.
Can this free checker confirm my website is safe?
No. It inspects public HTTP headers and a limited part of one page. A hidden PHP version, cache or firewall does not prove safety. Confirming remediation requires the actual web PHP package details across every serving instance.
Does the checker send exploit requests?
No. Flisko uses an ordinary GET request with a limited number of redirects. It does not upload files, send exploit payloads or stress PHP workers. Only check websites you own or are authorised to test.
Do I have to migrate WordPress because of PHP2Shell?
Not necessarily. A host-provided PHP fix and compatible application may be sufficient. Migration makes sense when your provider cannot supply a fix or your legacy application needs a maintained environment.
How much does PHP2Shell remediation or migration cost?
The price depends on the number of sites, hosting access, PHP version and application compatibility. Flisko prepares a scoped proposal with price and scheduling after the initial assessment. Using the free checker does not order a paid service.
Can you help agencies and companies outside Slovenia?
Yes. Flisko supports businesses and web agencies in Slovenia, Croatia and Austria. We can agree a review of multiple websites and coordinate upgrades or migration with the existing hosting provider.
Sources and the full guide
Let's agree the next step.
Need an urgent PHP2Shell assessment, upgrade or migration? Tell us about your environment. We will personally agree the priority, scope, price and available time slot.
- Assess the environment
- Agree a proposal
- Implement and verify