Patchferry

Get your PHP safely across.

PHP2Shell lets attackers take over servers running unpatched PHP, without logging in. We patch your servers, upgrade old PHP versions without breaking your site, and test everything before go-live.

Get a free assessment Read the fix guide

Fixed prices, paid by bank transfer or Payoneer. If we can't deliver a working upgrade, you don't pay.

Which PHP version do you run?

Run php -v on your server, or look in your hosting panel, then type the version here. The check runs in your browser and nothing is sent anywhere.

What happened, and what's next

On 21 October 2026, PHP released fixes for two critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10). Exploit attempts began four days before the announcement. The fix is a PHP update and a restart of PHP. Your website code doesn't need to change, unless you're on a version too old to receive the fix.

  1. First exploit attempts seen, before public disclosure
  2. Fixed releases published: 8.2.35, 8.3.36, 8.4.27, 8.5.12
  3. PHP 8.2 stops getting security fixes
  4. PHP 8.3 stops getting security fixes
Where each PHP version stands, as of 23 October 2026
VersionPHP2Shell fixSecurity fixes until
8.58.5.1231 Dec 2029
8.48.4.2731 Dec 2028
8.38.3.3631 Dec 2027
8.28.2.3531 Dec 2026
7.4 to 8.1No official release; vendor backports onlyAlready ended
7.3 and olderNoneAlready ended

Prices

Every job starts with a free assessment, so you know the exact price before you pay anything. All prices in US dollars.

One-time fixes

For servers that need patching now, or sites stuck on old PHP.

Free assessmentReply within 1 business day
Run our read-only check script on your server and send us the output. You get a written verdict, the risks, and a fixed quote.
$0
Emergency patchFor PHP 8.2 to 8.5
Update to the fixed release, restart every PHP worker, and confirm the version your website actually runs.
  • Basic php.ini hardening
  • Short written report you can show your team or auditor
  • Done within 1 business day of access
$149first server, then $79 each
Site upgradeWordPress and simple PHP sites
Move from PHP 7.4, 8.0 or 8.1 to PHP 8.4.
  • Theme and plugin compatibility fixes
  • Tested on a copy of your site first
  • Rollback plan for go-live
$249per site
App upgradeLaravel, Symfony, custom PHP
Library upgrades, automated and manual code fixes, static analysis, and your tests run on the old and new PHP. Delivered as a pull request for your team to review.
from $990fixed after assessment
Legacy rescuePHP 5.x, old frameworks
For code that hasn't been touched in years. We map what breaks, add safety checks where there are no tests, and move it to supported PHP in stages.
from $2,900fixed after assessment

Ongoing care

So the next PHP security release is handled without you having to think about it.

Site CareWordPress and simple sites
  • PHP security releases applied within 2 business days
  • Monthly WordPress, theme and plugin updates
  • Uptime monitoring and backup checks
  • Monthly report
$49per site per month
App CareLaravel, Symfony, custom PHP
  • Everything in Site Care
  • Library security checks and update pull requests
  • 2 hours of fixes each month
$149per app per month
Agency partnerWhite-label, under your brand
We patch and maintain your clients' sites, and reports carry your brand. Up to 15 sites included, and emergency patching costs $89 per site for 10 or more.
from $399per month

Jobs under $500 are paid upfront. Larger jobs are 50% to start and 50% on delivery. You can pay by international bank transfer or Payoneer, and we send a proper invoice. Monthly plans can be cancelled any time. See the refund policy.

How it works

The same four steps whether it's one site or two hundred.

  1. You run the check

    Our script only reads version information. It changes nothing and sends nothing; you copy the output to us.

  2. We send a fixed quote

    Within one business day: what's at risk, what we'll change, the price, and the timeline.

  3. We fix it on a copy first

    Upgrades are tested on a staging copy or a git branch. Your live site isn't touched until the fix works.

  4. You approve go-live

    We switch over together, confirm the live version, and hand you a report and a rollback plan.

What we don't ask for

  • Your passwords. We work with a temporary SSH key or user that you create and remove afterwards, or through your git repository.
  • Access to your live database. Upgrades are tested on a copy.
  • Payment before you see a quote. The assessment is free and you're under no obligation.

We sign your NDA if you have one, or send ours. We never scan or test servers we haven't been asked to look at. If someone emails you claiming they "found a vulnerability on your site" and wants payment, that isn't us.

If we can't deliver a working upgrade, you don't pay.

You agree the scope in the quote. If we can't complete it, we refund what you paid for that job.

Patchferry is run by Sheikh Rahat Mahmud, a PHP developer based in Dhaka, Bangladesh (GMT+6). See the work on GitHub.

Questions people ask

Do I need to change my website's code to fix PHP2Shell?

No. The flaws are in PHP itself, so the fix is updating PHP and restarting it. Code changes are only needed if you're moving up from an older PHP version, such as 7.4 to 8.4.

My host says they've patched. Am I safe?

Probably, if you're on shared hosting from a large provider. Still check: the version your website runs can differ from what php -v shows on the command line, and PHP workers keep running old code until they restart. Our check script covers both.

We're on PHP 7.4, 8.0 or 8.1. What are our options?

PHP published source patches for these versions but no official releases. Some OS vendors and paid support providers have backported the fix. That buys time, but the lasting fix is moving to PHP 8.3 or 8.4, which is what our upgrade packages do.

Will my site go down?

Patching needs a PHP restart, which usually takes a few seconds. Upgrades are tested on a copy first, and we switch over at a time you choose.

You're in Bangladesh. How do payment and invoices work?

You get a proper invoice in US dollars and pay by international bank transfer (SWIFT) or Payoneer. We work in GMT+6 and overlap with business hours in Europe, the Middle East and Asia, plus mornings in the US.

Get a free assessment

Fill this in and send it on WhatsApp or by email, whichever you prefer. Both open your own app with the message ready to send.

WhatsApp
+880 1518-732192
Email
sheikhrahatmahmud347@gmail.com
Reply time
Within a few hours, Sunday to Thursday, GMT+6. Urgent patching requests are answered any day.
Prefer a call?
Mention it in your message and we'll set up a Google Meet or Zoom.