Abrams Business Services · Abrams Patch Assist
Critical PHP runtime advisory — exposure check and patch support
On 21 October 2026 the PHP project released emergency fixes for a critical flaw in PHP (CVE-2026-109618 / CVE-2026-109619, often called PHP2Shell). Fixed builds include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA urges organisations to inventory PHP and patch internet-facing systems promptly. The UK NCSC likewise advises inventory, patching, and temporary mitigations. Updating WordPress plugins alone is not enough.
A foundational runtime issue — not a CMS plugin issue
These flaws sit in the PHP core that serves web requests. Updating WordPress plugins alone is not sufficient. Organisations should identify every PHP installation, prioritise internet-facing systems, and move to a fixed supported release. PHP 8.1 and earlier are end-of-life and do not receive these patches from the PHP project.
Check PHP version in WordPress Site Health
If you run WordPress, you can read the PHP version the site reports without installing extra plugins. Use this as an owner check — then confirm with your host in writing for managed hosting or multi-site stacks.
- In wp-admin, open Tools → Site Health.
- Open the Info tab.
- Expand Server.
- Note the PHP version serving this site.
- Compare it to fixed builds: 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (or later on those branches).
- Ask your host which runtime serves this domain — a package version on the server is not always the same as the worker serving traffic.
Need the host email template and inventory worksheet? Download the free PHP2Shell owner checklist, or open the Patch Assist portal when you want Abrams to run the exposure check.
What Abrams Patch Assist covers
Narrow, deliverable work: inventory, patch planning, coordinated patching and version verification. You grant time-boxed access in the portal and can revoke it at any time. We do not market this product as incident response, forensics, managed vulnerability management, or cyber-insurance readiness.
Exposure Check — £349
One site: runtime inventory, written patch plan, and interim mitigation notes drawn from official advisories. Includes UK VAT.
Patch & Verify — £899
One site: check plus Abrams applies or coordinates the patch, verifies the running version, then revokes access. Includes UK VAT.
Multi-site Patch — £1,999
Patch & Verify for up to five sites under the same legal entity. Includes UK VAT.
Runtime Watch — £249 / month
Version monitoring and a priority patch window for up to three sites. Not a full vulnerability-management platform. Includes UK VAT.
Immediate actions you should take
- Inventory — Find every system running PHP, including embedded runtimes behind CMS platforms.
- Patch — Move to a fixed supported build (8.5.12+, 8.4.27+, 8.3.36+ or 8.2.35+), restart workers, and confirm the running version.
- Mitigate while you patch — Follow interim guidance from the PHP advisories and, where applicable, your host or WAF vendor. Mitigations are not a complete substitute for patching.
Authoritative sources (references, not partnerships or endorsements): CISA alert of 21 October 2026; PHP security release announcement; NCSC guidance; NHS England Digital CC-4875 where applicable to your sector.
Free guide
Abrams PHP2Shell Owner Checklist
A claim-safe owner checklist: what PHP2Shell is, fixed PHP builds, an inventory worksheet, a host email template, and after-patch verification steps. It is not a penetration test and not Cyber Essentials for your organisation.
- Fixed builds: 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35 (or later on those branches).
- Inventory prod, staging, subdomains, and other PHP runtimes.
- Copy-paste host email that asks for the runtime serving this domain — not “WordPress is up to date.”
- Verify the running version and smoke-test login, forms, and checkout if you run WooCommerce.
Frequently asked questions
Is updating WordPress enough?
No. The vulnerabilities are in the PHP runtime. The host or stack PHP version must be patched or upgraded.
How do we give Abrams access safely?
After payment, the portal walks you through a time-boxed grant (application password, temporary deploy key, or hosting invite). You can revoke instantly; we revoke when the engagement closes.
Do you provide forensic incident response?
Not under this product. If a site is already compromised, contact us for a separate scoped discussion — that work is quoted manually and is not sold as a packaged Patch Assist SKU.
When can I pay online?
Stripe Checkout is available in the Patch Assist portal. Or email info@abramsgrp.com or call +44 115 777 0127.
Get expert help
Start free with the PHP2Shell owner checklist. When you need inventory done for you, or a coordinated patch under time-boxed access, use Abrams Patch Assist via the portal. Business Services: overview · Contact. Abrams Grp LLP · info@abramsgrp.com · +44 115 777 0127