Browse categories
Explore
Fiverr Pro
English
$
USD
I will patch your PHP server for php2shell and upgrade old PHP versions
About this Gig
Two PHP flaws, CVE-2026-109618 and CVE-2026-109619 (called PHP2Shell), were announced for PHP core. PHP rates both critical (CVSS v4 9.2). Both allow remote code execution without a login. One can also leak server memory.
Fixed releases came out on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no new release. The PHP team published source patches for 7.4, 8.0 and 8.1, and some distros ship backports.
Security vendors report exploitation attempts. On 26 October 2026, the US agency CISA added both flaws to its Known Exploited Vulnerabilities list. Patching takes little time, so do it now.
Basic also turns off session.upload_progress. PHP advises this for a third flaw, CVE-2026-115560, until its next regular release. The 21 October releases do not fix that one.
I do not promise a server is secure. I patch what is in scope and report what I did. Your staging copy stays on your server. I never download your database.
Server:
Apache HTTP
•
Virtual private server
•
Nginx
•
Web server
Operating system:
Linux
FAQ
Is my site already hacked?
I cannot tell from here, and this gig is not a malware scan. No package investigates compromise. If you suspect one, hire an incident responder first.
Do I have to shut my site down?
Not if you patch. If you cannot patch or apply the PHP team's interim mitigation soon, the UK's NCSC advises considering taking the system offline until it is fixed. End-of-life PHP should be isolated until it is upgraded.
I am on PHP 8.1 or older. What do I buy?
Basic gives a version check, a note on what to restrict, and a quote for Standard. Standard moves one small site to 8.3 or 8.4.
I am on shared hosting. Can you patch it?
I cannot change PHP on a host I do not control. In Basic I check the version and write the request you send to your host.
Can I give you root access?
No root password. Add my SSH key to a dedicated user with sudo, or create a time limited user. Share details in the Fiverr order thread only. You revoke the access on delivery. I record what I touched.
