On 21 October 2026 the PHP project rushed out emergency fixes for two severe vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Their severity score is 9.2 out of 10 - the worst kind of flaw, because an attacker can take over the entire server remotely with no login at all. Exploitation in the real world has already started. PHP is the engine behind roughly 70% of all websites, among them WordPress, Drupal, Laravel and CodeIgniter sites - so this is not a niche problem. One more myth to clear up: updating WordPress does NOT fix it. The fix has to happen at the server's PHP level, through patching or a full upgrade.
I'm a Senior Software Engineer (5+ years working with PHP and Laravel, including large-scale legacy migrations from PHP 5.x to 8.3). For clients in Yanbu I offer:
1. A free vulnerability assessment - I'll tell you exactly which PHP version you run and whether you're at risk.
2. Emergency patching to the fixed releases: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
3. Full version upgrades from 5.4, 7.x, 8.0 or 8.1 to PHP 8.3 / 8.4, with all resulting compatibility errors and bugs fixed by me.
4. Security hardening for WordPress, Drupal, Laravel and CodeIgniter websites.
5. Malware and hack cleanup for sites that are already compromised.
6. A server restart with post-fix verification, so you know the patch is live.
7. Better speed and stability as a bonus of the upgrade.
Be aware: hosting companies are patching slowly, and servers running PHP 8.1 or older will never get an official fix - an expert upgrade is their only option. Don't wait until you're dealing with a hacked, defaced or offline website.
Reach out for your free check:
Website: itsumarfarooq.com
Email: [email protected]
WhatsApp: +966 59 457 6805
I serve Yanbu, Madinah and all of Saudi Arabia (Riyadh, Jeddah, Dammam, Khobar), Qatar (Doha) and the Gulf - with remote service available worldwide.