A critical flaw has been found in PHP,
the engine behind many websites.
Many company websites and online stores run on PHP. In October 2026, a flaw that lets an outsider take over a website remotely was found in PHP, and it is already being exploited. Not sure whether your site is affected? Ask us. The first conversation is free.
Just enter your website’s URL in the contact form. The first conversation is free. Technical teams: see the vulnerability details.
What is PHP, and does it affect my company?
What is PHP?
A programming language that runs behind many websites. WordPress, and EC-CUBE (widely used to build online stores), are written in PHP. You cannot see it on screen, but sites with a contact form or a members’ area often use it.
What happened?
A flaw lets an outsider send commands to the server without logging in. If exploited, it can lead to a defaced website, stolen customer data, or malicious programs installed on the server.
What should we do?
Update PHP to a fixed version. Large hosting providers have often done this already. A server run by your company or your web agency, however, stays on the old version until someone updates it.
We recommend a check if:
- your website was built with WordPress
- you run an online store or a members’ area yourself
- your site was built by a web agency and you have no maintenance contract, or do not know what it covers
- you do not know who manages the server
You don’t need to be an expert to ask.
Send us your website’s URL and we will start by checking whether it uses PHP. The first conversation is free, and if your site is not affected, we will tell you so.
Want to check with your web agency or maintenance provider? A message ready to send
Send the message below (in Japanese) to the agency that built your website or to your maintenance provider.
当社のホームページ（URL： ）について、次の2点を教えてください。
① 使っているPHPのバージョン
② 2026年10月21日に公開されたPHPの修正版（PHP2Shell／CVE-2026-109618・109619 への対策）が適用済みかどうか No reply, or a reply you cannot interpret? Contact us, and forward the reply as is if you have one.
PHP2Shell (CVE-2026-109618 / 109619) in detail
On October 21, 2026, the PHP project released fixes for two critical vulnerabilities. Both can allow code execution on the server without authentication.
CVSS v4.0. Both flaws are rated “critical”. They require no authentication and can allow remote code execution.
PHP-FPM, Apache + mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP’s official advisory rates mod_php as the most exposed setup.
On October 26, 2026 (local time), the US CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalog. Japan’s IPA updated its alert on October 27.
- Fixed versions
- 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35
- Affected versions
- Earlier versions. PHP 8.1 and older are end-of-life and receive no official fix.
Is your site affected?
Answer four questions to see how urgent a check is. Your answers are not sent anywhere; the result is calculated in your browser. If you are not sure, choose “I don’t know”.
Three ways to start
Listed by urgency. All prices exclude tax; we start work after a written agreement on scope.
PHP Emergency Triage
We answer “are we affected?” within 48 hours. Along with the verdict, you get the temporary measures to apply tonight and step-by-step instructions.
- PHP version and execution mode (mod_php, FPM, CGI, etc.)
- Fix status, checked against installed packages
- Temporary measures and step-by-step instructions
- Whether you can update directly or need to migrate
- Quick check for suspicious files and processes
- Report: one-page summary for management plus technical details
PHP Security Check
We review the security of your PHP environments and set out the measures needed, in order of priority. Also suited to agencies and integrators checking several client environments at once.
- PHP version, patch status and execution mode
- Operating system, web server and package management
- Exposure to the current flaw and any end-of-life versions
- Risky settings (memory limits, upload limits, etc.)
- Priorities, recommendations and cost estimates
- Report: one-page summary for management plus technical details
PHP Patching
We apply security updates within the same release branch (for example 8.4.24 → 8.4.27), including testing, sign-off and a rollback procedure. Because the work touches production, the conditions are agreed in advance.
- Preliminary review and backup check
- Applied in a test environment, with tests of agreed functions
- Applied to production after your written approval
- Post-update checks of service and error logs
- Rollback procedure and completion report
More options
| Service | Price (excl. tax) | What it covers | Availability |
|---|---|---|---|
| Web Quick Scan (urgent) | JPY 150,000 | Limited to one domain and about 5 main screens, riskiest areas first. Includes a 30-minute debrief call. Turnaround: 48 hours. | From mid-November |
| Web Quick Scan (standard) | From JPY 100,000 | Automated testing of agreed URLs and functions, with results checked by a person. Test items chosen based on the OWASP WSTG. Up to about 10 screens. | From mid-November |
| PHP Version Migration | From JPY 300,000 | Migration from end-of-life versions or across release branches: compatibility testing, regression testing and cutover. | Available |
| Web Security Care | JPY 30,000 / month | Monthly version checks, end-of-support alerts, impact assessment of new vulnerabilities, a monthly report and questions answered during business hours. | Available |
| Legacy Code Remediation | Custom quote | Fixing incompatibilities found during an assessment or migration. Let’s discuss whether we can help; the scope varies widely, so we quote case by case. | Available |
The Web Quick Scan is a lighter assessment designed to go with the PHP check. It focuses on the riskiest areas, and automated results are checked by our experts. Ordered together with the PHP check, everything comes in one report. For a full assessment of your site, see Web & Mobile Assessment; to test whether a real attack would succeed, see Penetration Testing.
Bundles
Ordering together saves you coordination work. These are not discounts: we combine the reports and reserve the work slots.
Emergency Pack
Emergency Triage + PHP Patching
From assessment to recovery with one provider, with priority scheduling.
Full Review Pack
PHP Security Check (3 environments) + Web Quick Scan
Your PHP environment and your website in a single report.
End-of-Support Pack
PHP Security Check + Version Migration
PHP 8.2 reaches end of support on December 31, 2026.
Annual Pack
Web Security Care + Web Quick Scan (once a year)
Ongoing maintenance and a yearly review together.
An assessment that doesn’t stop at the report
A report is only useful if it gets read. We deliver one version for management, who decide, and one for the technical team, who act.
| Point | AEVUS | Typical assessment service |
|---|---|---|
| Turnaround | Emergency Triage within 48 hours | 2 to 4 weeks |
| Deliverables | One-page summary for management plus technical details | Technical report only |
| Responsibility | Through the rollback procedure and completion report | Ends when the report is delivered |
| Quality | Every deliverable reviewed by our technical lead in Japan | Varies by engineer |
| Ground rules | Written agreement on scope before any work | Starts on a verbal request |
| Assessment and fixes | Quoted separately; you may hire another provider for fixes | Fixes sometimes assumed to go to the same provider |
This table does not judge other providers. It shows what we commit to, in a form you can compare.
The steps
Because we work with administrator access, the scope is agreed in writing before any work starts.
First conversation (free)
The environment in question, how urgent it is and who maintains it. This step is free.
Scope
We identify the servers and the work, then sign a work agreement and a non-disclosure agreement.
Work
Only within the agreed scope. If we find an unexpected setup, we stop and talk to you first.
Quality review
Our technical lead in Japan checks the findings and the recovery procedures.
Report and walkthrough
We deliver the report and walk you through it. If an update or migration is needed, we tell you what it will cost.
Pricing
Prices exclude tax and are in Japanese yen. If the scope changes the price, we confirm the quote before starting.
| Service | Price (excl. tax) | Conditions | Turnaround |
|---|---|---|---|
| PHP Emergency Triage | JPY 100,000 | One environment, assessment only, up to 8 hours of work | 48 hours after we receive the information |
| PHP Security Check | JPY 50,000 | Up to 3 environments; JPY 12,000 per additional environment | 3 business days |
| PHP Patching | From JPY 100,000 | One environment, within the same release branch; urgent (within 48 hours) +50% | 5 business days |
| PHP Version Migration | From JPY 300,000 | One environment, up to 40 hours of work; beyond that, quoted separately | 3 to 8 weeks |
| Web Quick Scan (standard) | From JPY 100,000 | One domain, about 10 screens | 10 business days |
| Web Quick Scan (urgent) | JPY 150,000 | One domain, about 5 screens; 30-minute debrief call | 48 hours |
| Web Security Care | JPY 30,000 / month | One environment, 12-month contract, no setup fee | — |
| Legacy Code Remediation | Custom quote | Depends on requirements | — |
Additional charges
- Additional environments: From the 4th environment, JPY 12,000 per environment (PHP Security Check)
- Urgent work: Night, weekend, holiday or within-48-hours work: +50%
- Extensions: Rebuilding PHP extensions or changing custom code: quoted separately
- Recovery: Recovering from failures not caused by our work: quoted separately
If the work looks likely to exceed the agreed time, we stop and check with you first. No extra charges without your approval. Prices as of October 2026 and subject to change.
Frequently asked questions
Our team and security measures
This service is designed to protect your web systems over time, not just react once: regular checks and early warning before end of support. Your point of contact, contract management and final quality sign-off are handled in Japan; the work is carried out by engineers in India. Because you entrust us with administrator access, our own practices are defined by contract and procedures.
| Work accounts | Created per engagement, disabled within 24 hours of completion. No shared accounts |
|---|---|
| Credentials | Kept in an encrypted shared vault, accessible only to the engineers on the engagement |
| Work devices | No personal devices, encrypted disks, two-factor authentication required |
| Audit trail | Who did what, when and on which server: all recorded and kept for one year |
| Confidentiality | Non-disclosure agreement signed with the contract, also imposed on our subcontractors |
| Data handling | We do not copy or take away your data. Reports contain only what is necessary |
| Production work | Done only by engineers who have passed a technical test, always with a second person checking |
| Insurance | Professional liability insurance in place |
Before you order
- This service examines the state of the target environment and provides a verdict and recommendations. It does not guarantee the absence of vulnerabilities.
- The quick check cannot prove that no intrusion happened. Digital forensics is not included.
- The Web Quick Scan is different from penetration testing and source code review.
- Work is carried out after a written agreement is signed, on the agreed dates and within the agreed scope.
- Your site’s WAF or IDS may react during testing. Please let your team know in advance.
- Server configuration changes and application fixes are quoted separately.
Start by checking whether you are affected.
The first conversation is free. If your site is not affected, we will tell you so.