A fix page written for the person who has to do the fixing
Most security coverage of this incident is written for security teams. This site is written for the person holding the hosting login at 11pm: what is broken, what to type, and how to prove it worked.
Who runs this
PHP Hack Fix is run by Nathan Brown at HiVergent AI, a small AI and web consultancy in Dallas, Texas. It started because the same four questions kept arriving from clients in the first day of the PHP2Shell disclosure: is my site affected, is it a WordPress problem, did patching work, and was I hacked before I patched?
The site is independent. It is not affiliated with, endorsed by, or operated by the PHP Group, the PHP Foundation, Automattic, any hosting provider or any government agency. “PHP” is used descriptively to refer to the software.
How the content is checked
- Version numbers and fixed releases come from the PHP security advisory and the GitHub security advisories for the two CVEs, cross-checked against Ubuntu, Debian, Red Hat, cPanel and Plesk vendor notices.
- Exploitation claims are attributed to whoever observed them — Amazon Threat Intelligence, Cloudflare, CERT-EU, watchTowr — rather than presented as a general fact. Where agencies disagree, the disagreement is shown rather than smoothed over.
- Every page carries a review date. In a fast-moving incident, an undated page is a liability, so the date is at the top and it is meant literally.
- Commands are tested on the platforms named, and where something is a vendor backport that keeps an older version string, the page says so — that specific trap caused a lot of false “we're patched” reports.
What this site deliberately does not publish
No exploit code, no proof-of-concept payloads, no scanning tool aimed at other people's servers, and no instructions for hiding from a site owner. The version checker on the home page reads a version string you paste into your own browser; nothing is sent anywhere, and it cannot test a remote host.
If you find an error, the fastest correction is an email with the sentence you think is wrong and a primary source. Corrections are made in place, with the review date updated — not silently.
Getting help
If you would rather not do this yourself, HiVergent AI does the work: version inventory across hosts and panels, patch execution, verification evidence, and — where the server was exposed before patching — a compromise assessment with credential rotation and a written record of what was found.
Nothing on this site is a substitute for a professional engagement where the stakes justify one. If you are regulated, notify your insurer and your compliance contact before you start deleting evidence.
Contact
Corrections, source material, or a question the pages do not answer: hello@phphackfix.com. For incident work, use the consultancy site — it reaches a human faster.
Last content review: 22 October 2026.