Automatic PHP2Shell fix: one command, fixed price

What does the automatic PHP2Shell fix do?

The Entidex Emergency Fix patches PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on a Linux server with one command, for a fixed £149 per server, or £299 for PHP 8.1 or older. It checks the server first, shows you every change and waits for you to type YES, then updates PHP, checks your websites still load, re-checks and sends a signed, dated result.

1. Checks first, read-only. It runs the free PHP2Shell Check. If it finds signs of compromise, PHP it can't fix safely or a hosting control panel, it stops before changing anything.
2. Confirms your order. It checks your order is paid and covers this server.
3. Shows the plan. It lists every package the update will change and the PHP services it will restart, and stops if anything would be removed.
4. Waits for YES. Nothing changes until you type YES.
5. Backs up and updates. It saves your PHP settings and current packages, updates PHP through your own package manager and restarts PHP services only. If session upload progress is on, it also switches it off against the unpatched third flaw, CVE-2026-115560.
6. Checks your websites. If a site that loaded before stops loading, it puts the old packages and settings back.
7. Re-checks and signs. Only a clean re-check with your sites still loading gets a signed, dated "fixed" result.

How much does it cost?

The automatic fix is a fixed price per server:

Your PHP	Price per server
PHP 8.2, 8.3, 8.4 or 8.5	£149
PHP 8.1, 8.0, 7.4 or older	£299

You can pay by bank transfer or card, and see the plan with --dry-run before you pay. Just want proof your server is already fixed? The £49 Patch Check gives you a signed result without changing anything.

What is the cheapest way to fix PHP2Shell?

The cheapest fix is often free: if a host or agency manages your server, it is their job to apply the PHP update. Ask them to confirm in writing that the PHP serving your site is patched for CVE-2026-109618 and CVE-2026-109619. Our copy-paste emails make that quick.

If you run the server yourself and are comfortable on the command line, updating PHP from your system's packages and restarting PHP is also free. The free check script tells you whether it worked.

The automatic fix is for everyone else: when nobody has time, the server was set up by someone who has left, or you want a signed record for an insurer or client.

Which servers does it work on?

Linux servers where PHP comes from the system's own packages: Ubuntu and Debian (apt), and AlmaLinux, Rocky Linux and Red Hat (dnf). We test it on Ubuntu 24.04, Debian 12 and AlmaLinux 9 with a live site, including a site that breaks after the update.

On cPanel, Plesk, LiteSpeed and DirectAdmin servers the control panel manages PHP, so the script stops before changing anything and we patch the server by hand under the same order. It doesn't change PHP you compiled yourself or PHP inside containers: it tells you, and we help.

Can it fix PHP 7.4, 7.2 or 8.1?

PHP 7.4, 8.0 and 8.1 got no official PHP2Shell release, so the fix applies your vendor's patched packages where your system has them, for example Ubuntu Pro, RHEL or CloudLinux. The re-check reads the package changelog, so it can tell a patched PHP 7.4 from an unpatched one. If old PHP still isn't fixed afterwards, you don't get a "fixed" result and we take over. See your options for PHP 7.4 and 8.1.

How do I get started?

Order the Emergency Fix. The pro-forma email has your code and the command to run. While you wait for payment to clear, you can run the plan with --dry-run: it shows exactly what would change and changes nothing.

Only run it on servers you own or are authorised to manage.