PHP2Shell Emergency Response, Upgrades & Migration
The critical vulnerabilities in the PHP interpreter itself, disclosed on October 21, 2026 (CVE-2026-109618 / CVE-2026-109619), have led many companies and services to take their sites offline or into maintenance since October 21.
SolanaLink Co., Ltd. handles everything remotely, from assessment and applying the fixed release to migrating off old PHP and maintaining the site afterwards. We also take on sites whose original web agency can no longer be reached, and custom-modified sites with no documentation left.
Does any of this sound familiar?
- Your hosting provider has asked you to upgrade your PHP version
- After switching PHP versions, your site won't load or shows errors
- You can't reach the agency that built your site, or you have no maintenance contract
- Your site has been on PHP 8.1 or older (including 7.x and 5.x) for years without updates
- Your WordPress theme or plugins, or your EC-CUBE (a Japanese e-commerce platform) site, have been customized and can't be updated
- You're worried your site may already have been breached through these vulnerabilities
What you should know first
- If you're on PHP 8.2–8.5: applying the fixed release (8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or later) addresses the issue.
- If you're on PHP 8.1 or older: the PHP project does not publish fixed releases for 8.1 or older (minimal source-level fixes have been published, but you would have to build PHP yourself). We recommend checking for fixes from your hosting provider or OS vendor, or migrating to a supported version.
- Security support for PHP 8.2 ends on December 31, 2026. If you're migrating now, we recommend 8.4 or 8.5.
Services and pricing (incl. consumption tax)
Free quick assessment
Free
Based on your URL and server details, we tell you your PHP version, where your hosting provider stands, and what work is needed. We do not run any tests that attempt attacks from outside.
Fixed release / PHP switch, done for you (WordPress)
¥55,000 per site
Backup, update to the fixed PHP release or switch versions, check that pages and forms work, quick check for signs of intrusion (this does not guarantee that there has been no intrusion)
Fixed release / PHP switch, done for you (other PHP systems)
From ¥110,000 per system
EC-CUBE, Laravel, custom-built systems and more. Same work as above.
Migration off old PHP (8.1 or older → 8.4 / 8.5)
From ¥165,000 (quote)
Compatibility review in a staging environment, fixes to themes, plugins and custom code, production cutover, and preparing a rollback procedure
Server move
Quote
Moving from an old server to a server or cloud that runs a supported PHP version
Monthly maintenance
From ¥5,500/month
See the plans below
| Service | What's included | Price |
|---|---|---|
| Free quick assessment | Based on your URL and server details, we tell you your PHP version, where your hosting provider stands, and what work is needed. We do not run any tests that attempt attacks from outside. | Free |
| Fixed release / PHP switch, done for you (WordPress) | Backup, update to the fixed PHP release or switch versions, check that pages and forms work, quick check for signs of intrusion (this does not guarantee that there has been no intrusion) | ¥55,000 per site |
| Fixed release / PHP switch, done for you (other PHP systems) | EC-CUBE, Laravel, custom-built systems and more. Same work as above. | From ¥110,000 per system |
| Migration off old PHP (8.1 or older → 8.4 / 8.5) | Compatibility review in a staging environment, fixes to themes, plugins and custom code, production cutover, and preparing a rollback procedure | From ¥165,000 (quote) |
| Server move | Moving from an old server to a server or cloud that runs a supported PHP version | Quote |
| Monthly maintenance | See the plans below | From ¥5,500/month |
Monthly maintenance plans (incl. consumption tax)
Lite
¥5,500/month
WordPress core and plugin updates (once a month), backup checks, and monitoring and alerts for PHP and WordPress vulnerabilities
Standard
¥16,500/month
Everything in Lite, plus uptime monitoring, a monthly report, and minor fixes (up to 1 hour a month)
Pro
¥33,000/month
Everything in Standard, plus: when an urgent vulnerability appears, we start on your site ahead of other requests during our hours (the fee covers up to 3 hours of work a month); upkeep of a staging environment
| Plan | What's included | Price |
|---|---|---|
| Lite | WordPress core and plugin updates (once a month), backup checks, and monitoring and alerts for PHP and WordPress vulnerabilities | ¥5,500/month |
| Standard | Everything in Lite, plus uptime monitoring, a monthly report, and minor fixes (up to 1 hour a month) | ¥16,500/month |
| Pro | Everything in Standard, plus: when an urgent vulnerability appears, we start on your site ahead of other requests during our hours (the fee covers up to 3 hours of work a month); upkeep of a staging environment | ¥33,000/month |
Notice under the Specified Commercial Transactions Act (Japanese)
How it works
- 1Apply using the form (about 5 minutes)
- 2Within 1 business day, we email you the results of the free assessment, the proposed work and a quote
- 3Once you place an order, we tell you separately how to share access details (please do not send passwords through the form or by email)
- 4We take a backup, verify everything in a staging environment, then apply it to production
- 5We deliver a work report, and move to monthly maintenance if you need it
How we keep the work safe
- Before starting work we take a backup and prepare a rollback procedure
- Before changing production, we check pages and behavior in a staging environment wherever possible
- We never accept passwords or other access details through the form or in the body of an email
- We sign a non-disclosure agreement (NDA) on request
- We make no promise that attacks “can be completely prevented”. We tell you honestly where things stand and what the risks are
Scope and important notes
- We take requests on weekdays, 10:00–18:00 JST, and as a rule reply within 1 business day (it may take longer when we receive many requests). We do not offer 24-hour emergency response
- Requests are handled first come, first served. Our capacity is limited, so you may have to wait
- We do not carry out full forensic investigations where a breach has already been confirmed. We recommend consulting a specialist firm
- We only accept requests from a site's administrator or someone with the administrator's permission. We cannot assess third-party sites
- We send free assessment results only to someone we can confirm is the site’s administrator (we may ask you to contact us from an email address on the site’s domain, for example)
- This service is for sites run as a business by companies, organizations and sole proprietors
- The scope of work, responsibilities and payment terms are agreed in a contract (or a purchase order and acceptance) before you place an order. We never start work before the contract is in place
- We work in English, Japanese and Simplified Chinese
Frequently asked questions
- Q. I'm on shared hosting. Do I need to do anything myself?
- A. Your hosting provider updates PHP itself. But if you have an old PHP version (8.1 or older) selected in your control panel, take care: some providers have fixed it themselves, but future fixes are not guaranteed. Check your provider's announcements and which PHP version you have selected. If you're not sure, our free assessment will tell you.
- Q. We can't reach the agency that built our site, and we don't know how it works.
- A. Get in touch. As long as you can access the server and the admin panel, we start by working out how the site is put together.
- Q. Should we take our site offline until it's fixed?
- A. For sites that handle personal data or payments, pausing the site or showing a maintenance page until the fixed release can be applied is one option. We'll advise once we understand your situation.
- Q. Can companies outside Tokyo use the service?
- A. Yes. Everything is done online, by email and video call.
Free assessment and consultation form
It takes about 5 minutes. Please do not enter passwords or login details. Do not enter private keys, API keys or raw logs either.