Your site may be running a version of PHP that will never be patched.
On October 21, 2026, two critical flaws nicknamed “PHP2Shell” were confirmed in the core of PHP: they let anyone run their code on your server, no password required. Maintained versions were patched within days. PHP 8.1 and everything before it never will be. We put your site back on a safe base for $490 — on a fresh template, or pixel-identical.
What just happened
On October 21, 2026, two critical vulnerabilities — CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 — were confirmed in the core of PHP. Not in a plugin, not at one particular host: in the engine itself, the one that runs a large part of the web. Their combination has a name, PHP2Shell, because it lets an attacker run code on the server and install a web shell — a backdoor that stays after the break-in. The exploit code leaked within days, and CISA, the US cybersecurity agency, published an alert the same day.
Every PHP version from 5.4 through 8.5.11 is affected. The still-maintained branches received a patch: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. But PHP 8.1 and every earlier version are end-of-life: no patch will ever come for them. A site running PHP 8.1, 7.4, 7.2 or 5.6 stays exposed forever — until someone replaces the engine. That is the work this page offers to do.
How easy it is
The mental picture is a determined attacker working on your door. The reality is more mundane — which is exactly the problem:
No password required
The attack is “unauthenticated”: one specially formed HTTP request is enough. Nothing was stolen, nobody reused a weak password — the server itself executes the attacker’s code.
No trace in the logs
The public exploits return their result inside an ordinary HTTP response, without crashing and without writing anything to the server logs. Most intrusions are discovered weeks later — when Google blacklists the site, or the host suspends the account.
Nobody is targeting you
Scanners crawl the web continuously, 24 hours a day, looking for exposed versions. You are not a chosen target: you are one address on a list. Once the code is public, it takes no talent and no motive — just waiting your turn.
Hosting configuration barely matters
The flaw is in the core of the language. Edge mitigations exist, but they are band-aids: the only door that truly closes is the update to a patched version.
Where does your site stand?
The PHP version is not an engineering detail — it is information you are entitled to. Enter the address: we look, like an anonymous visitor, at what your site exposes today.
Passive detection: a single request, no passwords, nothing stored. What is not visible from the outside can only be confirmed by your host — or by us, with access.
The offer: $490, two paths
One price, two ways to use it, depending on what your current site is worth today. Either way, the essentials are identical: no more condemned version, a maintained base, and a page-by-page verification before going live.
A new site on a modern template
You restart on a clean, fast, maintained template. We carry over your content and pages, preserve your domain and, wherever possible, your addresses and search ranking. This is the right path if the current site also bothered you on the outside — or if it is already infected: starting from a fresh base removes the infected code by construction.
Technical update, like for like
Your site does not change by a pixel: same design, same pages, same addresses. It is the engine that gets replaced — PHP and its dependencies move to a patched, maintained version, and the whole thing is verified before and after. This is the right path if the site works for you as it is.
What the flat fee covers
The diagnosis
PHP version, CMS, extensions, hosting: the exact state of what exists, in writing, with the recommended path and the reason.
The chosen path, done
Fresh-template rebuild or technical version bump — the actual work, not a patch slapped on in a hurry.
Your content, preserved
Pages, copy, images, addresses: everything is carried over, then checked page by page. What moves is documented; what is not flagged does not move.
Verification before go-live
Rendering, navigation, forms, search ranking: the site is tested before and after, and the report is handed to you in writing.
The settings that shrink the attack surface
What gets exposed, what must stop being displayed, what updates itself: the hygiene measures applied along the way, explained plainly.
Short, clear documentation
What was done, what changed, where to see the current version — one page your next provider, us or anyone else, can read.
The honest parts
What the flat fee is not
$490 covers a brochure-scale site or equivalent — a few dozen pages, not a business application. Heavy e-commerce, a customer portal, a WordPress site stacked with exotic plugins, or cleaning up an active intrusion all exceed that scope. We will tell you at the diagnosis, and it becomes a separate quote — no surprise increase halfway through.
An update is not a talisman
We close one known door and put your site back on a maintained base. No serious provider will promise you an impenetrable site; what we promise is that you stop being the open door everybody knows about — and that the next door that opens has a patch that exists.
If the site is already hacked
Cleaning up an intrusion is a different job from updating it: it gets a separate quote after the diagnosis. It is also the case where path 1 is often the cleanest — restarting from a safe base removes the infected code instead of hunting it file by file.
Questions we get asked
My site is “just” a brochure site. Who would hack it?
+
Nobody, precisely — and that is why it happens. These attacks are automated: they do not pick a target, they try every address, continuously, all night. A hacked site is used to send spam, host phishing pages, or attack other machines — and it is your name, your domain and your reputation that carry the consequences.
Doesn’t my host take care of this?
+
Hosting and site are two different layers. A host can perfectly offer PHP 8.4 while your site — too old to run on it — stays locked to a condemned version. And for PHP 8.1 and earlier there is nothing to “switch on”: no patch will ever exist. The flaw is in the language itself, so only a site moved back onto a maintained version closes the door.
Can you really guess my version without touching my site?
+
That is exactly what the checker above does: one anonymous request, and we read what the site itself exposes — the X-Powered-By header, the PHPSESSID cookie, the WordPress signature. Some sites announce everything; others show nothing. In that second case the version can only be confirmed server-side, by your host or by us with access. The checker tells you honestly which case you are in.
Why $490?
+
Because the work is bounded and the repetitive parts are machine-handled: diagnosis, content carry-over, update, page-by-page verification. You pay for a verified result, not for suspense. And if your site falls outside the flat fee’s scope, the diagnosis says so — before any commitment, not after.
How long does it take?
+
Typically one working week between access and verified go-live — a little more for a full rebuild, a little less for a straightforward version bump. The free check beforehand takes as long as one exchange.
Do you keep permanent access to my site?
+
No. Access is temporary and returned at the end of the engagement. What stays with you is the site and its documentation — nothing else. What we deliver has to be usable by any provider, us included: that is the rule for everything we ship.
Why “the third way”?
+
Because between doing nothing and hoping, and the five-figure rebuild everyone postpones year after year, the middle path was missing: a bounded package, a printed price, and the problem closed in a week. That is exactly what this page offers.
Where this fits
Legacy Archaeology
For the system nobody understands anymore: two weeks to read everything, trace everything, write it all down, with a verified blueprint at the end. The same conviction at depth — you only repair well what you have understood.
Read the page →The five-minute readWhat “the third way” means
Not all-human, not all-machine: the task split that makes a bounded $490 package possible at all — agents on the repetitive work, seniors on the judgment.
Read the page →Everything elseThe other ways to work with us
Software development, automation, upskilling, risk assessment — always the same engine, and always bounded commitments.
Read the page →Prefer to write?
Your site’s address, a question about the flat fee, a doubt about the detected version — write to us. A real human reads every message — no CRM queue, no auto-responder — and we reply within one business day.
From: you, straight to our inbox
Reply time: one business day
Spam filter: invisible, human-only door
Old-fashioned email works too: hello@thethirdwaycompany.com