How Xeretec
Can Help

1. Assess: identify potential exposure
We’ll check your external websites and web applications to establish where PHP is in use and whether any are running affected versions.

2. Remediate: address any external vulnerabilities
If your systems are affected, we’ll work with your IT team, developers or hosting provider to apply the necessary security updates. If an update isn’t immediately possible, we’ll help identify appropriate interim protections.

3. Secure: verify and protect
We’ll check that the fixes have been applied correctly and review your systems for signs of unusual activity since 17 October. We’ll also recommend practical steps to help reduce the risk of future vulnerabilities.

What You Get With Our
PHP Vulnerability Assessment

Same-day response

A consultant is assigned on the day your order is processed, with testing typically completed within hours.

Checks for both vulnerabilities

We’ll assess your external exposure to both PHP vulnerabilities and confirm in writing if your systems are not affected.

Clear, actionable findings

If a vulnerability is identified, you’ll receive a report with evidence to help your team prioritise remediation.

Independent reporting and advice

Receive a clear report you can share with clients, suppliers and partners, alongside practical guidance on the steps needed to address any issues.

Assessment
FAQs

PHP2Shell refers to two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed by the PHP project on 21 October 2026. Both are rated critical, with a CVSS score of 9.2, and could allow unauthenticated remote code execution on vulnerable systems. This means an attacker could potentially execute malicious code without first logging in.

PHP is a widely used programming language for websites and web applications, including many built using content management systems. You may not know which technologies your website uses, particularly if it is managed by a third-party hosting provider or development agency. Xeretec can carry out an exposure check to identify where PHP is running and establish whether affected versions may be in use.

Your exposure depends on the PHP version running on your systems and whether the relevant security fixes have been applied. Xeretec can assess your websites and web applications, check for affected versions and provide a clearer picture of your exposure. Where further testing is required, we can provide a written report with findings and proof-of-concept evidence where a vulnerability is identified.

The security releases addressing these vulnerabilities include PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If you are running an affected version, updating to an appropriate patched release is an important step towards addressing the vulnerabilities. Older, unsupported PHP versions may require a branch upgrade or an alternative supported arrangement. Xeretec can work with your IT team, developers or hosting provider to identify the appropriate remediation steps. If an update cannot be applied immediately, we can help identify suitable interim protections.

The service helps you understand your exposure, verify potential vulnerabilities and determine what action is required. It starts with an initial check to identify where PHP is running and whether affected versions may be present, followed by dedicated consultant-led testing and verification. You’ll receive a written report detailing the findings, including proof-of-concept evidence where a vulnerability is confirmed, along with practical remediation guidance to help address any issues identified. The service also includes a review for signs of suspicious or unauthorised activity dating back to 17 October 2026.

If testing identifies a vulnerability, Xeretec will provide findings and practical guidance to help you prioritise the necessary fixes. We can work alongside your internal IT team, developers or hosting provider to apply the appropriate security updates. Where immediate patching is not possible, we can help identify interim mitigation measures, such as suitable firewall protections, while a permanent fix is arranged.

A consultant is assigned on the day your order is processed, and testing is typically completed within hours. Actual turnaround will depend on the systems being assessed and the scope of testing required. You will receive a report outlining the findings and recommended next steps.