Emergency PHP patch
€99
Price per website, for the scope described
We check PHP, upgrade it to a patched release, check that the website works, look for signs of a break-in and send a written report. For one website.
Hrvatski
As of 22 Oct 2026
PHP released patches for two critical vulnerabilities (“PHP2Shell”). Source: php.net
Emergency PHP patch: we upgrade your website’s PHP for you
€99 per website
Fixed price, no VAT added. What’s included
You need us if you run a VPS or your own server, are on PHP 8.1 or older, or aren’t sure the patch has been applied.
We check which PHP version your website actually runs, upgrade PHP to a patched release, check that the site works, look for signs of a break-in and send you a written report. We handle WordPress, WooCommerce, Joomla, PrestaShop, Magento, Drupal, Laravel and custom PHP, including websites we didn’t build. We work remotely from Zagreb, Croatia (CET), and the whole job is done online.
We get back to you the same day, 7 days a week.
01 — PHP2Shell
With sources and dates
What happened
Patches released 21 Oct 2026
PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (“PHP2Shell”), that can allow remote code execution without logging in.
Severity: critical
PHP’s severity rating: CVSS v4.0 9.2.
Older versions are affected too
Wiz says all unpatched versions from 5.4 onward are affected, including old 5.x and 7.x. Croatia’s National CERT says the 5.x–8.x branches are potentially affected.
Sources: Wiz: PHP2Shell (21 Oct 2026); Croatia’s National CERT: critical vulnerabilities in PHP (21 Oct 2026, in Croatian)
The problem is in PHP on the server
Updating WordPress, a theme or a plugin doesn’t change PHP. The complete fix is upgrading PHP and restarting the PHP processes.
Sources: php2shell.com (as of 22 Oct 2026); Cloudflare: PHP vulnerabilities and WAF protection (21 Oct 2026)
A firewall doesn’t replace the upgrade
A firewall (WAF) or Cloudflare only reduces the risk temporarily.
Sources: php.net: PHP 8.5.12 released, “no complete mitigations” (21 Oct 2026); Cloudflare: PHP vulnerabilities and WAF protection (21 Oct 2026)
Advisories in Croatia
Croatia’s National CERT and NCSC-HR published advisories on 21 Oct 2026. They recommend updating urgently and checking whether systems are infected.
Sources: Croatia’s National CERT: critical vulnerabilities in PHP (21 Oct 2026, in Croatian); NCSC-HR: critical vulnerabilities in the PHP programming language (21 Oct 2026, in Croatian)
02 — Who it’s for
Hosting, VPS or server
Do you need us?
You need us if at least one of these applies.
You run your own VPS or server
Large hosting companies have told VPS customers to upgrade PHP themselves. We do that upgrade for you.
Sources: Hostinger: protecting against PHP2Shell (21 Oct 2026); GoDaddy: PHP security update for website owners (22 Oct 2026)
Your website runs on PHP 8.1 or older
PHP 8.1 and older (7.x, 5.x) no longer receive updates from the PHP project. There are only minimal source-code patches for 7.4, 8.0 and 8.1, and patches from some vendors. We recommend moving to a supported version; that move is priced by scope, with a written quote before work starts.
Sources: php.net: PHP security releases (21 Oct 2026); php.net: supported PHP versions (as of 22 Oct 2026)
You don’t know who manages your hosting
Nobody maintains your website, or you don’t know who has access to the hosting. All we need to start is your website’s address.
You’ve noticed something unusual
You’ve noticed unknown files, unknown admin accounts or strange redirects on your website. The check for signs of a break-in is part of the package.
Shared hosting
On shared hosting, PHP is usually upgraded by the hosting company. Large hosting companies have announced that they are applying the patch. Not sure whether yours has applied it? For €99 we check whether the patch is in place and put our findings in a written report.
Sources: Hostinger: protecting against PHP2Shell (21 Oct 2026); GoDaddy: PHP security update for website owners (22 Oct 2026)
03 — The package
For one website
What you get for €99
PHP check
We check which PHP version and handler your website actually uses, and whether the patch has already been applied. Vendor patches often keep the old version number, so we check the package changelog.
Source: CloudLinux: CVE-2026-109618 and CVE-2026-109619 (22 Oct 2026)
Upgrade
We upgrade PHP to a patched release (8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your vendor’s patch) and restart the PHP processes.
Website check
After the upgrade we check the home page, forms, login, cart and checkout, and file uploads.
Check for signs of a break-in
We look for unknown PHP files in the web directory, new scheduled tasks (cron jobs) and unknown admin accounts.
Written report
The report says what we found, what we did and what we recommend.
- The price shown is what you pay. No VAT is added: Delmis Solutions j.d.o.o. is not in the VAT system (Article 90(1) of the Croatian VAT Act).
- The price covers the scope described. We quote any additional requests separately, in writing, before work starts.
- Hosting, domains, licenses, subscriptions, other third-party fees and maintenance after delivery are not part of the price unless the service description lists them explicitly.
Shared hosting: if your hosting company has already applied the patch, we confirm that for the same €99 and put our findings in a written report.
04 — Priced by scope
Outside the package
What’s not included
These aren’t part of the €99 price. For a cleanup, a move off old PHP or ongoing maintenance, you get a written quote before work starts.
Website cleanup after a break-in
If the check finds signs of a break-in, we quote the cleanup separately.
Moving off old PHP
Moving from PHP 8.1 or older (7.x, 5.x) to a supported version, with the theme, plugin or code changes it needs, is quoted separately.
Third-party fees
Hosting, domain and licenses aren’t part of the package price.
Ongoing maintenance
We offer maintenance after the upgrade as a separate service.
05 — Process
6 steps
How it works
No hourly billing: €99 per website covers everything in the package.
Get in touch by phone, on WhatsApp or through the form. We get back to you the same day, 7 days a week.
We arrange access: your hosting control panel (cPanel, Plesk or DirectAdmin), or SSH for a VPS.
We check PHP and look for signs of a break-in.
We upgrade PHP and restart the PHP processes.
We check that the website works.
We send you a written report. If a cleanup or a move off old PHP is needed, you get a written quote before work starts.
Questions
With sources
Common questions
I’ve updated WordPress. Isn’t that enough?
No. The problem is in PHP on the server, and updating WordPress, a theme or a plugin doesn’t change PHP. The complete fix is upgrading PHP and restarting the PHP processes.
Sources: php2shell.com (as of 22 Oct 2026); Cloudflare: PHP vulnerabilities and WAF protection (21 Oct 2026)
I use Cloudflare. Isn’t that enough?
No. A firewall (WAF) or Cloudflare only reduces the risk temporarily and doesn’t replace the PHP upgrade.
Sources: php.net: PHP 8.5.12 released, “no complete mitigations” (21 Oct 2026); Cloudflare: PHP vulnerabilities and WAF protection (21 Oct 2026)
Can I put my website into maintenance mode?
That doesn’t help. Maintenance mode in WordPress or Magento doesn’t protect the site, because PHP processes the request before the application sees it.
Source: Sansec: PHP2Shell (21 Oct 2026)
Has my website been hacked?
We can only tell after a check, and the check for signs of a break-in is part of the package: unknown PHP files in the web directory, new scheduled tasks (cron jobs) and unknown admin accounts. What we find goes into the report.
My website runs on PHP 7.4, 8.0 or 8.1. What does that mean?
The PHP project no longer releases updates for these versions. There are only minimal source-code patches and patches from some vendors. We recommend moving to a supported version; that move is priced by scope, with a written quote before work starts. PHP 8.2 gets security fixes until 31 Dec 2026.
Sources: php.net: PHP security releases (21 Oct 2026); php.net: supported PHP versions (as of 22 Oct 2026)
Is anyone already trying to exploit the vulnerabilities?
Attack attempts have been reported since 21 Oct 2026 (Amazon, watchTowr), and a public tool is being used for mass scanning (CloudLinux, 22 Oct). As of 22 Oct, no successful break-in has been publicly confirmed.
Sources: Amazon: PHP2Shell in its MadPot sensor network (21 Oct 2026); watchTowr: PHP2Shell (21 Oct 2026); CloudLinux: CVE-2026-109618 and CVE-2026-109619 (22 Oct 2026)
I’m on shared hosting. Do I need you?
On shared hosting, PHP is usually upgraded by the hosting company. Large hosting companies have announced that they are applying the patch. Not sure whether yours has applied it? For €99 we check whether the patch is in place and put our findings in a written report.
Sources: Hostinger: protecting against PHP2Shell (21 Oct 2026); GoDaddy: PHP security update for website owners (22 Oct 2026)
Do you work on websites you didn’t build?
Yes. We work with WordPress, WooCommerce, Joomla, PrestaShop, Magento, Drupal, Laravel and custom PHP, on shared hosting, a VPS or your own server.
What access do you need?
Your hosting control panel (cPanel, Plesk or DirectAdmin), or SSH access for a VPS. We arrange access when we first talk.
Founder
Zagreb
Who’s behind Delmis Solutions
Karlo Đelmiš, founder and director — a senior software engineer with experience in payment integrations for online marketplaces, application security and applied artificial intelligence.
We do the work and you confirm everything works; we check facts against official sources and cite them.
Delmis Solutions j.d.o.o. · Zagreb, Croatia · OIB (tax number) 68158074750 · MBS (registration number) 081704558, Commercial Court in Zagreb · Legal information (in Croatian)
Contact
Available 7 days a week
We upgrade PHP for you.
Send us your website’s address and, if you know it, who hosts it. We take care of the rest.