From €229 per server (US: $249)
Senior engineers · Fixed price · 14-day warranty · Since 1999
Quick Answer
Optimum Web patches PHP2Shell (CVE-2026-109618 and CVE-2026-109619) at a fixed price: €229 / $249 for one server, €590 / $649 for up to five. We identify every PHP runtime that serves web traffic, install the fixed build from your distribution, panel or container base image, restart all workers, verify the running version, apply interim mitigations where no fix exists, and deliver a dated per-host report. Work starts within 4 business hours of order during CET business hours.
Ubuntu 24.04, RHEL 9 and Plesk fixed the bug without changing the PHP version. Others show a new CLI version while the website is still served by an old FPM pool. We check package build strings against vendor advisories, not php -v.
A patched package does nothing until every FPM pool and Apache process restarts — gracefully, without dropping live traffic. Containers need rebuilt images, not just a restart.
PHP 8.1, 8.0 and 7.x get no release from the PHP project. We find the right backport for your platform, or apply PHP's documented mitigations and give you a dated upgrade plan.
Every host and image you give us: OS, PHP versions, SAPI (mod_php, FPM, CGI, LiteSpeed, FrankenPHP), which PHP serves which site, panels and bundled PHP (phpMyAdmin, monitoring, helpdesk tools).
Snapshot or backup confirmed before we change anything. If no backup exists, we tell you before we proceed.
Fixed build from the right source — distro security repo, Ubuntu Pro/ELTS where you have it, Sury/ondrej, cPanel EA4, Plesk, DirectAdmin, CloudLinux, or a rebuilt Docker image on the fixed official tag.
Graceful restart of all PHP workers and web servers. We confirm the running build per pool and check the site responds normally.
For runtimes without a fix yet: memory_limit/post_max_size hardening at admin level, session.upload_progress.enabled=0, web-server request limits, origin lock-down to your WAF/CDN.
For hosts exposed and unpatched since 20 October: process, file, cron, user and outbound-connection checks for obvious signs of exploitation. This is triage, not full forensics — if we find something, we stop and tell you.
Per host: before/after package versions, vendor advisory reference, time of patch, workers restarted, mitigations applied, triage findings, open risks and recommended next step.
€229
(US: $249)
SEC-PATCH-01 · 14-day warranty
€590
(US: $649)
SEC-PATCH-02 · 14-day warranty
from €1,490
(US: from $1,590)
SEC-PATCH-03 · 14-day warranty
Prices exclude VAT where applicable. Access via SSH key or temporary user; we never ask for passwords in email. Hosts beyond the package are quoted at €89 / $99 each.
Illustrative scenarios built from the stacks we maintain and vendor advisories as of 25 October 2026. Not client case studies.
From Symfony news portals with 50,000+ daily visitors to e-commerce platforms whose backups we rescued — see the case studies below.
The engineers who patch are the same team that runs our penetration tests.
No hourly surprise. The price above is the price on the invoice.
The same format our compliance clients hand to auditors.
Real PHP work we have shipped:
Order or send the form with host count and access method.
We confirm scope and send an access checklist (SSH key, sudo, maintenance window).
We patch and verify, keeping you updated in your channel of choice (email, Slack, Teams, Telegram, WhatsApp).
You receive the report. Optional: we schedule the upgrade plan.
Last verified:
Within 4 business hours of order during CET business hours (Mon–Fri 10:00–18:00 EET). After-hours windows are available if booked in advance.
SSH with sudo (key-based or a temporary user you remove afterwards), or panel admin access for cPanel/Plesk/DirectAdmin. For containers: access to the repository/CI and registry, or we send you a merge request.
Normally no. We use graceful restarts. Where a full restart is needed we agree the window with you first.
Yes: we verify what your host deployed and give you the evidence, or we prepare the exact request to send them.
No one can from a quick check. Our triage catches common signs of exploitation; if we see any, we stop, preserve evidence and recommend proper incident response.
Yes. We work remotely with clients in the EU, UK, Switzerland and the US; prices are shown in EUR and USD.
Patching once is reactive. Our maintenance plans and PHP version upgrades keep you on supported branches so the next fix is a routine update.
Reviewed by
