Find and close your PHP2Shell exposure AI-enabled senior European software engineers. Fixed scope. Evidence at every step.
On 21 October 2026 the PHP project disclosed two critical remote-code-execution vulnerabilities — CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell, each rated CVSS 9.2 and now under active exploitation. Because the flaw sits in the PHP runtime itself, updating WordPress, Drupal or your plugins does not close it. AROBS inventories every PHP system you operate, patches what can be patched, isolates what cannot, and replaces the end-of-life systems that will never receive a fix.
Trusted by Global Organisations
How we close the exposure
A measured, evidence-led response — not a scramble
PHP2Shell is a runtime flaw, so it reaches further into an estate than most inventories show. We work in three stages, and we show our evidence at each one: what we found, what we changed, and how we confirmed it.
Know exactly where you are exposed
PHP runs behind a large share of the web, and it is embedded in more systems than most teams track. We inventory every PHP site, application and server in your estate — including the ones nobody remembers — and test each against the patched release for its branch.
Patch, then verify the live runtime
We upgrade every supported branch to its patched release — 8.2.35, 8.3.36, 8.4.27 or 8.5.12 — and confirm the runtime actually serving traffic is the patched one, not the version your documentation assumes. Anything that cannot be patched immediately is placed behind a restricted proxy with interim mitigations.
Replace what cannot be patched
PHP 7.4 to 8.1 have no official fixed release, and 7.3 and earlier are end-of-life. Where no patch is coming, AI-enabled senior European software engineers rebuild the systems you depend on — prioritised by real usage, with AI-assisted delivery — so you move off unpatchable PHP in days rather than quarters.
Where PHP hides
Are you exposed?
If any of the following runs in your environment, confirm its PHP version. The runtime is the common denominator — the application on top of it does not change the risk.
WordPress, Drupal, Joomla, Magento / Adobe Commerce. Full takeovers have been demonstrated against all four.
WooCommerce, Craft CMS, TYPO3, Concrete CMS, MediaWiki, Pimcore.
PrestaShop, OpenCart, Shopware.
Anything built with Laravel, Symfony, CodeIgniter, CakePHP, Yii or Zend / Laminas.
Moodle, Nextcloud, SuiteCRM, SugarCRM, Mautic, Matomo, Roundcube, osTicket, WHMCS.
phpMyAdmin, cPanel, Plesk, GLPI, Zabbix, pfSense — plus vendor appliances and Windows software that bundle PHP.
Patch available now. Upgrade to 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12.
No official fixed release. Upgrade, or confirm a backported fix from your distribution or an extended-support vendor.
End-of-life. No fix is coming — isolate, then replace.
A third related flaw, CVE-2026-115560, was disclosed shortly afterwards; we factor its interim mitigations into the same assessment.
The engagement
What we deliver
A fixed-scope engagement that closes your exposure and leaves you with a clear record of what was found, changed and verified.
Exposure audit
Every PHP site, application and server inventoried with its version, hosting and configuration — including the forgotten ones.
Patch and verify
Supported PHP branches upgraded, with the live runtime confirmed as the patched release — not the one assumed in your documentation.
Emergency lockdown
Systems that cannot yet be patched are placed behind a restricted proxy with interim mitigations, so attackers cannot reach them.
Replacement plan
A usage-based migration plan and a fixed-scope quote for each end-of-life system that has to be rebuilt.
Case study
A legacy Drupal site, replaced in a day
A client's entire estate ran on end-of-life Drupal, and when PHP2Shell broke, patching was not a realistic option. A CodingScape engineer isolated the servers behind a proxy, rebuilt the critical pages in order of real usage with AI agents, and took PHP offline within two hours — with the pages that mattered replaced inside a day.
* Case study delivered by CodingScape, part of AROBS Group.
Beyond the emergency
From patched to future-proof
The audit and lockdown close your immediate exposure. These add on, at a fixed scope, to get you off legacy PHP for good and keep you current.
AI-assisted system migration
End-of-life PHP systems are replaced with modern equivalents, rebuilt in order of what your team actually uses. AI-assisted engineering compresses the delivery timeline while AI-enabled senior engineers own the architecture and the data.
Ongoing patch management
We monitor and maintain PHP and your other critical dependencies, so the next runtime advisory is a routine update rather than an emergency — a predictable operating cost instead of an unplanned one.
Scope & terms
Clear scope, agreed before we start
Cost & terms
Scoped per engagement
Your checklist before kickoff
A short list of what we need from you to begin:
- A point of contact, and a technical owner who can approve changes.
- Access to hosting, cloud accounts, repositories and DNS / CDN.
- Your list of known sites and applications — even a rough one.
Final cost depends on the number of systems, PHP versions and hosting environments. Not included: the full system replacement build (a separate fixed-scope engagement), compromise review or incident response, and hosting, licensing or WAF costs. Scope and price are confirmed in writing before any work begins.
Speak with us
A clear read on your PHP exposure, in one conversation.
Tell us roughly what you run. We will map where you are exposed, patch what we can, isolate what we cannot, and give you a fixed-scope plan for anything that has to be replaced.
Common questions
How this works
We updated WordPress (or Drupal). Are we protected?
Our host manages our servers. Do we need to act?
What if we are on an old PHP version?
What do you need from us?
Do you check whether we have already been compromised?
Know where you stand on PHP2Shell
One conversation to map your exposure, patch what we can, and scope what we cannot.