Rapid Patch
Close PHP2Shell on every server in scope, with a report you can hand to your insurer.
- Inventory of every PHP install and SAPI
- Interim mitigations within 4 business hours
- Patch, restart, verify
- Compromise check back to 20 October
PHP2Shell · CVE-2026-109618 · CVE-2026-109619
Patch PHP2Shell today. Stay ahead of the next one.
AEGIS fixes the PHP flaw behind the October advisory on servers you own, checks for signs of compromise, then watches every site daily so the next critical update never catches you out.
CVSS 9.2 unauthenticated RCE
Fixed in 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35
Patched 21 Oct 2026
# shop.example.com (authorized scope #A-1042) php -v 8.3.14 VULNERABLE sapi php-fpm upload_progress On mitigate post_max_size 64M lower # after Rapid Patch php -v 8.3.36 PATCHED upload_progress Off ok fpm workers restarted ok secrets rotated 4 of 4 ok eol warning 8.3 ends 31 Dec 2027 # reviewed by technician · report sent
Written authorization firstWe never scan or touch a server you haven't signed a scope for.
A human reviews every alertAutomated daily checks, confirmed by a technician before we contact you.
You approve every changeNo fix is applied without your written OK.
Recorded remote sessionsEvery RDP session is ticketed, approved live and recorded.
Services
Fix it now, then keep it fixed
Four services cover the whole lifecycle of a PHP vulnerability, from the emergency patch to the migration off an unsupported version.
Sentinel monitoring
Our Super Intelligence system checks each server or site daily against live vulnerability feeds.
- Technician-reviewed alerts
- Critical PHP patches within 48 hours of approval
- End-of-life warnings 120 days ahead
- Monthly security score report
Remote RDP support
Hands-on help from a technician when you need it, on your terms.
- Scheduled through a ticket
- You start or approve the session live
- Connected through a VPN or gateway
- Every session recorded
Legacy Lifeline
For servers on PHP 8.1 or older, where 7.3 and earlier have no fix at all.
- Stopgap backport where one exists
- Isolation and a web application firewall
- Compatibility audit
- Planned migration to supported PHP
How it works
From sign-up to monitored in four steps
Create an account
Sign up with Google or Apple and pick a plan. No payment or server access yet.
Sign your scope
A free consult maps your servers. You sign a written scope listing exactly what we may touch.
We patch and verify
Mitigations first, then the fixed PHP build, a restart and a compromise check, all in one report.
Sentinel keeps watch
Daily checks and human-reviewed alerts. You approve each future fix before it's applied.
Pricing · USD
Fixed prices, cancel monthly plans anytime
| Add-on | What's included | Price |
|---|
Annual plans include two months free. Every quote states its cancellation and refund terms before you agree to buy. Card payments go through Stripe, and we never see or store your card number. Paying doesn't give us access to anything: work starts only after you sign a scope.
Your account
One login for your plans, reports and support
Log in with the Google or Apple account you already have. We only receive your name and email address.
- No passwords to manageGoogle and Apple handle sign-in, including two-factor.
- Pay when you're readyPay by card through Stripe now or after your free consult. Work starts after a signed scope.
- We will never cold-call for accessWe never ask for passwords, card numbers or a remote session over the phone. Verify us at this site before sharing anything.
New here or coming back?
The same button creates your account the first time and logs you in after that.
Questions
Before you sign up
Have you scanned my site?
No. We only check systems after you sign a written scope. If anyone claiming to be AEGIS says your site is hacked without one, it isn't us.
What is "Super Intelligence"?
Our automated system checks your servers daily against live vulnerability feeds and flags issues. A technician reviews every alert before we contact you or change anything.
My host handles updates. Do I need this?
Maybe not. Many hosts patch the server but not the PHP versions you chose or your apps. Ask them whether the 21 October update is applied; the free consult can help you check.
We already patched. What else matters?
Restart PHP so the fixed build loads, and rotate secrets on any exposed server, because the flaw could leak worker memory such as passwords and keys.
Can I cancel?
Monthly plans cancel anytime from the billing link we email you, or by replying to any receipt. One-time patches are a fixed price agreed in your scope.
Why sign in with Google or Apple?
It means we never store a password for you, and your account gets the same two-factor protection as your Google or Apple ID.