P01
PHP2Shell Exposure Assessment
Review identified PHP environments, relevant runtime versions, vendor fixes and application dependencies. Receive a prioritized assessment of affected systems and recommended next actions.
PHP2SHELL | HANDS-ON ENGINEERING SERVICES
Patch the vulnerability. Restore the service.
V8Y offers six standalone engineering services for authorized teams responding to PHP2Shell, from patching alone or forensic assessment alone to combined remediation, temporary containment and system recovery. Select the work needed; no V8Y platform purchase is required.
CVE-2026-109618 / CVE-2026-109619 / Security updates released October 21, 2026
Engineering services only. No V8Y platform purchase or deployment required.
Do not share passwords, internal IP addresses, sensitive logs, source code or controlled government information through the public form.
THE CURRENT ADVISORY
Why this matters now
On October 21, 2026, the PHP security team released updates for two critical vulnerabilities that can permit unauthenticated remote code execution in affected web-serving PHP environments. The issue warrants prompt identification of exposed runtimes and appropriate vendor-supported updates.
Systems taken offline as a precaution may still need dependency checks, compatibility corrections, runtime verification and controlled functional testing before they return to service. Installing a patch does not establish whether a system was previously compromised.
Fixed upstream versions announced October 21: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Vendor backports and end-of-life upgrade paths vary by environment. Always verify the current vendor advisory.
SIX STANDALONE SERVICE PACKAGES
Choose the engineering support you need
Each package can be requested independently. We agree on the specific systems, tasks, deliverables, acceptance criteria and authorization before work begins.
P02
PHP2Shell Patch & Verification
Apply approved, vendor-supported PHP security updates or upgrades under customer change control. Verify active runtime versions and agreed application functions, with a documented change record.
P03
PHP2Shell Forensic Assessment
Review an agreed set of available logs and system evidence for indicators of possible exploitation. Receive documented findings, evidence reviewed, limitations and recommended next actions.
P04
PHP2Shell Patch + Forensic Assessment
Coordinate authorized evidence preservation, bounded forensic review, approved remediation and post-change checks. Receive a consolidated record of findings, changes and verification results.
P05
PHP2Shell Emergency Containment
Implement customer-approved temporary isolation, access restrictions or other exposure-reduction measures when immediate patching is not possible. Document remaining risk and the path to a supported fix.
P06
PHP2Shell System Recovery & Restoration
Restore defined applications and supporting services using customer-approved recovery resources. Validate agreed operational functions and document any unresolved dependencies or risks.
Each package is available as a separately scoped professional service. Work begins only after technical fit, required access and security conditions, deliverables, commercial terms and customer authorization are established. Forensic findings depend on the evidence available; containment is temporary; restoration and patching do not establish that a system was never compromised.
Need just the patch? Choose P02. Need investigation without changing production? Choose P03. Need both? Choose P04. Assessment, temporary containment and recovery are also available separately.
Clear boundaries for every package
Included when expressly contracted
- Only the selected P01–P06 tasks for named systems and evidence sources
- Defined reports and objectively reviewable handoff materials
- Customer-approved changes or recovery actions where applicable
- Agreed security, evidence-handling and operational procedures
Not automatically included
- Unbounded breach investigation, enterprise-wide threat hunting or malware eradication
- Penetration testing, exploit attempts or changes without written authorization
- Legal attribution, legal opinions, breach notification decisions or courtroom testimony
- Handling of classified or controlled data without appropriate contractual and security arrangements
P03 and P04 may include a bounded forensic assessment only with qualified personnel and an authorized evidence scope. P05 is temporary containment, not a substitute for approved patching. P02 patching and P06 restoration do not establish the absence of compromise. Suspected active compromise remains under the customer's designated incident-response authority.
DEFINED DELIVERABLES
A documented result for the work ordered
Each engagement has a named report and scope-specific acceptance criteria. The report describes the work performed, evidence or versions reviewed where applicable, the results, limitations and unresolved issues.
- P01: Exposure Assessment Report
- P02: Patch Completion & Verification Report
- P03: Forensic Findings & Evidence Report
- P04: Combined Remediation & Findings Report
- P05: Containment Action & Residual Risk Report
- P06: Operational Restoration Report
Only the deliverables named in the authorized statement of work are included. Completion reporting is not a guarantee that remediation, recovery or a compromise investigation will reach a predetermined outcome.
ENGAGEMENT PROCESS
A straightforward engagement
1 | Select a package and discuss the need
Choose P01 through P06, or select Not sure. Explain at a high level whether the relevant service is operating, restricted or offline.
2 | Agree on scope and authorization
We confirm technical suitability, qualified staffing, affected systems, evidence/data requirements, customer responsibilities, deliverables, acceptance conditions and commercial terms before work begins.
3 | Perform work and hand off results
Authorized engineers complete the agreed tasks with the customer team and provide the documented findings and verification results.
GOVERNMENT ACQUISITIONS
Straightforward for technical teams and contracting offices
V8Y offers six separately purchasable PHP2Shell professional engineering packages. An agency may request only an exposure assessment, patch and verification, forensic assessment, a combined patch-and-forensic scope, temporary containment, or defined system recovery.
For each requested package, V8Y can prepare a statement of work and quotation identifying named systems, authorized tasks, customer responsibilities, evidence and security requirements, objective deliverables, acceptance criteria and the proposed period of performance. Firm-fixed-price terms may be proposed when the work can be bounded appropriately.
No work starts until the responsible government or prime-contractor purchasing authority, technical owner, required security process and written access/change authorization are established. Initial inquiries should contain no sensitive system details; technical evidence is handled only through an approved channel and authorized scope.
REQUEST SUPPORT
Request PHP2Shell engineering support
Select the PHP2Shell engineering package you need and share a few non-sensitive details about your organization and service status. We will review technical fit and discuss an appropriately scoped engagement. Do not submit system evidence through this public form.
COMMON QUESTIONS
Questions before you contact us
Do we have to purchase the V8Y platform?
No. P01 through P06 are independent professional engineering services. No V8Y software platform purchase, installation or deployment is required.
Can we request patching without a forensic assessment?
Yes. P02 covers authorized patching and verification without a forensic investigation. P03 is available separately for a bounded forensic assessment, and P04 combines the two activities under one authorized scope.
Can we request a forensic assessment without patching?
Yes. P03 is a separately scoped review of agreed, available evidence. Findings are limited by the evidence and scope; P03 does not include production patching or guarantee a definitive determination of compromise.
What if we cannot patch immediately or a service is offline?
P05 covers customer-approved temporary containment, which does not replace a supported fix. P06 covers defined, authorized restoration. The relevant technical and security owners must agree on conditions before changes or recovery actions begin.
Can V8Y work with our existing IT team or prime contractor?
Yes. V8Y can work with authorized government technical teams or an existing prime contractor under a properly established agreement that defines responsibilities, access and deliverables.
Can we request a fixed-price quote?
We can propose firm-fixed-price terms when the systems, work, dependencies and acceptance criteria are sufficiently defined. No public price list is provided; commercial terms are established through a separate quotation.
OFFICIAL REFERENCES
Incident guidance reviewed October 22, 2026. Consult the current PHP and vendor advisories before making technical changes.
All six services are subject to verified qualified staffing, technical fit, secure evidence/data-handling requirements, required authorizations and agreed contracting terms. Forensic assessment, temporary containment and restoration are performed only within specifically authorized scopes. V8Y does not claim an engagement with any affected agency through this notice.