Active threat PHP2Shell · two critical PHP flaws · emergency patches Oct 21, 2026 · exploits public
Your website, patched in 24 hours. Then protected every month after.
Most small-business websites were built years ago on PHP and have never had a security pass. This month that stopped being a theoretical problem. We find what is exposed, fix it, put a firewall in front of it, and keep it patched so you never have to think about it again.
Two bugs in PHP itself, not in anyone’s code.
CVE-2026-109618 and CVE-2026-109619 (together “PHP2Shell”) are flaws in the PHP engine that runs roughly three out of four websites, including every WordPress, WooCommerce, Joomla, Drupal and Magento site. Both are rated 9.2 out of 10. An attacker needs no password and no mistake in your code: an unpatched server can be made to run their commands. PHP 8.1 and older, still common on cheap hosting, will never be fixed.
- Oct 20Details leak two days ahead of the planned disclosure. Attackers start working from the leaked information.
- Oct 21PHP ships emergency releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA tells organizations to patch immediately or take PHP systems offline.
- Oct 21–22Exploit attempts observed by security researchers and major CDN providers, who deploy temporary firewall rules. Proof-of-concept code circulates.
- NowAutomated scanning for unpatched PHP sites runs around the clock. Sites are found by address range, not by size or fame.
One plan. One fix. No surprises.
The Deep Scan & Fix is the work that closes the door. Protect is what keeps it closed.
Feli-Scan Protect
+ $999 one-time Deep Scan & Fix. Payment plans available.
- Deep Scan & Fix (first 24 hours): authorized full scan, PHP and CMS patched to the fixed versions, vulnerable plugins updated or removed, malware and backdoor sweep, admin and server hardened, written report.
- Web application firewall in front of your site with PHP2Shell rules from day one.
- Weekly external re-scan with alerts the moment something changes.
- Security patches applied within 24 hours of release.
- Daily off-site backups and a tested restore.
- Monthly plain-English report for you, your clients or your insurer.
- Priority response if something gets through.
Starts from your free scan: sign in to your vault, or scan first.
Secure Rebuild
For sites too old to patch, or businesses that want this to never happen again.
- Rebuilt on a modern stack with no PHP to exploit.
- Hardened against automated and AI-driven attacks: strict headers, bot and rate protection, locked-down forms, no exposed admin.
- Faster, mobile-first, set up for search and AI answers.
- Content, branding and rankings carried over.
- Includes the first year of Protect.
Free scan first
20 seconds, read-only, from the outside.
- Sixteen checks including PHP2Shell exposure.
- Grade, findings with evidence, plain-English fix plan.
- Reviewed by a certified AI professional before it is sent.
Free scan vs. Deep Scan & Fix vs. Protect
The free scan sees what any visitor can see. The Deep Scan sees inside, with your written authorization, and fixes what it finds. Protect keeps it that way.
| Check or action | Free scan | Deep Scan & Fix | Protect (monthly) |
|---|---|---|---|
| PHP2Shell exposure (external) | ✓ | ✓ | ✓ weekly |
| Security headers, HTTPS, exposed files, admin pages | ✓ | ✓ | ✓ weekly |
| Known vulnerable plugins and libraries | ✓ | ✓ | ✓ weekly |
| PHP version confirmed on the server | — | ✓ | ✓ |
| Authorized active scan (OWASP ZAP, Nuclei) | — | ✓ | ✓ quarterly |
| Malware, backdoor and rogue-account sweep | — | ✓ | ✓ monthly |
| PHP, CMS and plugin patching | — | ✓ | ✓ within 24 h of release |
| Web application firewall | — | ✓ set up | ✓ managed |
| Daily off-site backups and tested restore | — | ✓ set up | ✓ monitored |
| Written report | ✓ summary | ✓ full | ✓ monthly |
| Priority response to an incident | — | — | ✓ |
From exposed to protected in a day.
Free scan
You enter your address, we read what your server tells every visitor, you get a grade and a report. Nothing changes on your site.
Authorize
One signed page gives us permission for the active scan and access to your hosting. Credentials go into our vault, never over email.
Deep Scan & Fix
Firewall first, backup second, then clean, patch, upgrade and harden. Verified from the outside and the inside. Report delivered within 24 hours.
Protect
Weekly re-scans, 24-hour patching, daily backups, monthly report. If a fix needs a rebuild, we tell you plainly and quote it.
Questions
Why not just ask my hosting company to update PHP?
Do, today, if you can. On many sites the CMS, theme or plugins break on a newer PHP, which is why they were never updated in the first place. The Deep Scan & Fix handles the whole chain, on a staging copy first, so the upgrade sticks.
Is $999 the whole cost of the fix?
For a typical small-business site, yes: scan, cleanup, patching, upgrade and hardening are included. If we find a site needs substantial rework (a theme that cannot run on supported PHP, a custom application, or a store with heavy customization) we tell you before any extra work and quote it, or recommend a rebuild.
What does “hardened against AI-driven attacks” mean?
Attack tools now use AI to find targets, guess passwords, fill forms and probe for weaknesses at scale. A hardened site gives them nothing to work with: no exposed admin, no version disclosure, strict headers, bot and rate protection on every form, and no PHP engine to exploit. Nothing is unhackable; the goal is to be the hardest, least rewarding target on the block.
Can I cancel Protect?
Yes, any time. The Deep Scan & Fix is one-time work and is owed in full. Your firewall and backups stay yours.
Do you need to touch my domain or hosting?
For the firewall, yes: your domain’s DNS points at the firewall, which then talks to your host. We do this with you and it takes minutes. Everything else happens inside your existing hosting account.
Do you work with agencies?
Yes. If you manage sites for clients, ask about per-site pricing for ten or more.
Start with the free scan.
Twenty seconds tells you whether this is urgent. If it is, we can have a firewall in front of your site today.