• Security & Recovery · PHP

Updating the PHP version on your site: after PHP2Shell, an old version is an open door

On 20 October 2026 two critical vulnerabilities in the PHP interpreter itself were made public: CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. The attacker needs no authentication, and any PHP site is exposed: WordPress, OpenCart, Joomla or custom code. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For PHP 8.1 and older there is no official fix, only builds from hosting providers and vendors. Updating is the only reliable protection, but on an old site it runs into plugins and modules that do not work on the new version. We do it on a copy, check everything step by step and leave you a written report. More on the event itself: see our PHP2Shell article in the blog.

See how it works
Price
after a free audit
Guarantee
30 days after project sign-off
Focus
sites and stores; WordPress, OpenCart, Laravel
Price
after a free audit
Guarantee
30
days after project sign-off
Focus
sites and stores; WordPress, OpenCart, Laravel
Timeline
we name it after the review
Start
free review of the current state
Warranty
30
days from the date the acceptance act is signed
Reply
within 2 hours
Terms
under a written contract
What's included

Complete list of work and what you get as a result

  • an inventory of PHP versions on the site, subdomains, test copies and the server
  • a compatibility check of plugins, themes and modules on a separate copy of the site
  • updating PHP to a fixed version and restarting all processes
  • replacing or fixing whatever does not work on the new version
  • limits on request size and field count, disabling unneeded features, WAF rules
  • a check for signs of compromise and rotation of secrets if there are any
  • a written report: what was updated, what remains open and why
When this service isn't right

What's not included — so there are no surprises at delivery

  • a guarantee that the site will not be hacked
  • investigating an existing breach: that is separate work
  • rewriting third-party plugins and modules that are no longer maintained
  • ongoing supervision after the work, unless agreed separately
Who it's for

Situations where this service delivers results

Scenario 1 of 4

A site on PHP 7.x or 8.0 to 8.1

These branches have no official PHP fixes. You need to move to a supported version or to a verified build from your host.

We'll review your situation in a free audit
Free audit

Free review of the current state

We look at what is visible about the site from outside and tell you how urgent it is. Often this is a short conversation rather than a project.

What we measure

  1. PHP versionThe most important point. If it is visible in the headers, we see it. If not, we ask you to look in the hosting panel.
  2. Hosting and fixed buildsHosts often backport fixes into old packages without changing the number. We look at the build date and the changelog.
  3. Subdomains and copiesOld test sites on the same account can run on another, long outdated version.
  4. Plugins and modulesHow many there are and how many are still maintained by their authors. They decide how hard the update will be.
  5. BackupsAnd whether anyone has tried restoring from them. An update without a verified backup is done only in an emergency.

What you get

  • a list of versions on the site and subdomains
  • an answer on whether it is urgent and what can be done quickly
  • a scope estimate broken down by stage
  • an honest answer if there is no urgency

Timeline: 1–2 working days

Why is it free

We check the version and build date within an hour. We see no point charging for that, still less in scaring anyone without reason.

What's next

You get the list and the estimate. Then you decide; the document stays with you.

Short form: your contact and site URL
Contract and paperwork

We work officially

Contract, act and invoice — for every project, not just large ones.

Trusted by6 brands

Trusted by: Kvant Energy, GYPSUN, Naturel Cosmetics, Pancer Protection, LUGI, BeeTech

Terms fixed in writing8 points

  • Contract, act and 30-day warranty

    Every project gets a written contract: scope, deadlines, amount, acceptance procedure. After delivery — act and invoice, then 30 calendar days of warranty.

  • Sole proprietor & bank transfer

    The contractor is a registered sole proprietor. Payment by invoice with closing documents.

  • Rights & access — yours

    Code, design and materials transfer to you after full payment. Domain, hosting, repository and analytics are registered to you.

  • Client portal instead of email chains

    During the project you get access to a portal: contracts, invoices, acts and project status in one place.

  • Sites in nine countries

    Our sites run in nine countries: besides Ukraine — Poland, Germany, Austria, England, Norway, Bulgaria, Moldova and Spain.

  • Verifiable numbers

    Every case in the portfolio comes with a link to a live site and a technical measurement.

  • Audit first, then pricing

    There is no price list on the site intentionally: the scope of the same work differs multiples between clients.

  • We say "no" when unsure

    If the task isn't ours or the deadline is unrealistic — we tell you upfront.

  • Contract, act and 30-day warranty

    Every project gets a written contract: scope, deadlines, amount, acceptance procedure. After delivery — act and invoice, then 30 calendar days of warranty.

  • Sole proprietor & bank transfer

    The contractor is a registered sole proprietor. Payment by invoice with closing documents.

  • Rights & access — yours

    Code, design and materials transfer to you after full payment. Domain, hosting, repository and analytics are registered to you.

  • Client portal instead of email chains

    During the project you get access to a portal: contracts, invoices, acts and project status in one place.

  • Sites in nine countries

    Our sites run in nine countries: besides Ukraine — Poland, Germany, Austria, England, Norway, Bulgaria, Moldova and Spain.

  • Verifiable numbers

    Every case in the portfolio comes with a link to a live site and a technical measurement.

  • Audit first, then pricing

    There is no price list on the site intentionally: the scope of the same work differs multiples between clients.

  • We say "no" when unsure

    If the task isn't ours or the deadline is unrealistic — we tell you upfront.

We sign NDAs on request. After completing the work, we delete our access to your services ourselves.

What affects the price

Why two seemingly identical tasks are priced differently

  • From which version to whichFrom 8.1 to 8.3 is one thing. From 5.6 or 7.0 to 8.4 touches most plugins and the theme, which is a different scale of work.
  • Number of plugins and modulesEach one is someone else's code. One no longer maintained by its author has to be replaced or fixed.
  • Custom codeIts compatibility can only be checked by reading and running it, so it takes more time.
  • Number of sites and serversTaking inventory of several projects and subdomains adds time for each.
Cases

Tasks and results in numbers — all metrics measured by us

a sample of 41 Ukrainian online stores

Task
Assess the technical base of the stores: whether there is a usable sitemap and whether the platform is being updated.
Solution
External measurement of the homepage and one product page taken from the sitemap: traces of features in the HTML, product markup, prices and attributes. Presence of the trace, not the quality of the implementation.
Result
Measured on 17 September 2026, 35 stores: PHP without security support: 2 sites out of 35; no usable sitemap: 7 sites out of 35; sitemap points to another domain: 2 sites out of 35.
Reviews

What clients wrote on Kabanchik, quoted verbatim and unedited

Рекомендую виконавця - завжди на звязку, виконав завдання вповному об'ємі швидше, ніж вимагалось, по всім питанням отримав розгорнуті відповіді.

Original

АртурОткатить сайт на Opencart к старому бэкапу с сохранением всех товаровReview on Kabanchik
Очень рад, что нашёл такого графитного специалиста!

Original

Петр В.Почистить сайт от вирусовReview on Kabanchik

Did not find your case?

Describe how it works on your side — we will tell you whether “PHP update and server hardening” fits and what it means in your situation. No brief and no call: one question, one answer.

Process steps

Transparent stages with approval at every step

Total duration:3–15 days

  1. Inventory

    1–2 working days

    We collect PHP versions across all sites, subdomains and copies and check whether fixed builds exist.

  2. A copy for testing

    1–3 working days

    We bring up a separate copy of the site. You cannot update a live site blind: compatibility only shows in practice.

  3. Updating on the copy

    1–7 working days

    We move to the fixed version, check the main scenarios, fix or replace whatever is incompatible.

  4. Switching the live site

    1 working day

    We switch the version, restart all PHP processes and check pages and errors.

  5. Hardening and report

    1–2 working days

    Request limits, disabling the unneeded, monitoring. A written report of what was done and what remains.

Technologies & integrations

What we build on and what it connects to

Stack

  • PHP
  • WordPress
  • OpenCart
  • WooCommerce
  • Laravel
  • nginx
  • Apache
  • PHP-FPM
  • LiteSpeed
  • Cloudflare
  • SSH

Integrations

  • Cloudflare
  • cPanel
  • ISPmanager
  • Plesk
  • Telegram
  • Email
Update ahead of time or leave it as is

How this option differs from the alternative

Leave the old versionOur approach
Protection from PHP2Shellstays vulnerablea fixed version with a restart
State of the site during the workrunning until it is hackedrunning; the update is done on a copy
Costzero before the event and unpredictable after itplanned and known in advance
Later updatesevery new vulnerability becomes permanenta path to a supported branch
What we need from you

We can't start without this — best to prepare in advance

  1. access to the hosting or server and to the site admin area
  2. which hosting you use and the current PHP version, if you know it
  3. a list of plugins, themes and modules, especially custom ones
  4. whether there is a backup and whether anyone has tried restoring from it
  5. who on your side accepts the work
If something is missing — let us know, we'll help you gather it or do it as a separate task.
FAQ

Most frequently asked questions — with concrete answers

Is my WordPress site vulnerable?

Yes, if PHP on the server has not been updated to a fixed version. The flaws are in PHP itself, not in WordPress or a plugin, so updating WordPress does not close them. Safe versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or later.

What should I do if I have PHP 7.4 or 8.1?

Those branches have no official PHP fixes. Hosts and vendors (for example cPanel, CloudLinux, TuxCare) ship builds with the fix backported. So look at the build date and the changelog, not only the number. The more reliable route is to move to a supported branch.

Can I just click the version switch in the hosting panel?

Technically yes, but the risk of breaking the site is real: old plugins, themes and modules may not work on the new version. So we test on a copy first and switch the live site once we know the result.

Do you guarantee we will not be hacked?

No, and anyone who does is not telling the truth. Updating and hardening reduce the risk considerably but do not replace backups and monitoring.

What if the site may already have been breached?

Change passwords and keys, since process memory may have been read, and restore the site from a backup made before 20 October after updating PHP. Investigating a breach is separate work, and we will say so plainly at the review.

How much does it cost and how long does it take?

It depends on the age of the site and the number of plugins. There is no public price list on purpose: updating a fresh site and an old store with thirty modules are different amounts of work. We name the sum and the timeline after the free review.

Let us find out which version your site runs on

We will check the version and fixed builds and tell you how urgent it is. The review is free, we reply within 2 hours.

View cases
  • Reply within 2 hours
  • No commitment
  • We work under a contract

There is no price list on the site on purpose: the same work differs several times over between two clients, and a “from” figure explains nothing in that case. First a free audit — we count your pages, duplicates and speed — then we name the sum and the deadline and fix both in the contract.