Patch the PHP.
Keep solar orders moving.
Your B2B sales portal keeps installers supplied. If it was built years ago and you don’t have a developer to call, the PHP security news can leave you wondering where to start.
We help solar distributors running Magento or WooCommerce understand what needs attention and work through the update. Start with a free conversation.
A clear next step.
A cost you agree to.
Your portal has been doing its job for years. Then a newly disclosed PHP vulnerability throws a spanner in the works. We’ll help you work out what needs attention.
The first conversation is free. We’ll discuss what needs checking and agree the scope and cost of any work before it starts.
Let’s talk it through-
Tell us what’s worrying you.
Tell us what you’ve heard or share an email from your host. You don’t need to diagnose the problem or write a technical brief. We’ll talk through the situation and help work out what needs checking.
-
Agree on a focused first step.
We’ll explain the options, outline a useful piece of work and quote before starting. You decide whether to go ahead. Any further work is agreed with you first.
-
Make the changes with a plan.
We work through the update with your hosting provider, test changes on a separate copy and check the parts your installers rely on. We agree when to update the live portal and prepare a way back if something goes wrong.
We know the solar business behind the portal.
Our work in solar connects the tools behind proposals, customer records and day-to-day operations. We understand that installers need the right stock, the right trade prices and orders they can rely on.
See our solar customer storiesPHP is where our team started.
Our developers built their early careers working with PHP. That experience helps us make sense of older code, hosting setups and custom connections, including the parts the original contractor may never have documented.
We can work through the setup, talk to your hosting provider and explain the options in plain language.
Modern tools. Experienced judgment.
We use AI-assisted engineering to trace unfamiliar code, identify update blockers and support testing. That helps us investigate efficiently, while experienced developers review the changes and decide what is ready to go live.
Solar customers & integration work
A selection of our solar integration and proposal work.
“The software integrations they’ve built for us between OpenSolar, Scanifly and JobTread have streamlined our workflows and saved us countless hours of manual entry.”
On our solar integration work.
Tell us about your portal.
Start with your name and email. If you have an alert or a budget in mind, add that too. It’s fine to leave the technical fields blank.
We’ll respond to confirm availability and talk through a next step. Any paid work and its cost are agreed with you first.
admin@palebluedawn.comA few things you might be wondering.
I don’t have a developer. Can you still help?
Yes. That is exactly the situation this service is for. Tell us what’s worrying you and whatever you know about the problem. Old handover notes or a hosting email can help, but you don’t need to understand the setup before getting in touch.
What if I don’t know who hosts the portal?
You can get in touch even if you don’t know. An old hosting invoice or an email from the original contractor can help later. We’ll work out what information is needed as we talk through the next steps.
Will my installers still be able to order?
Keeping the ordering process working is part of the plan. We agree the important checks with you, test changes away from the live site and discuss any maintenance window before deployment. Backups and a rollback plan are part of that preparation.
What if my hosting company has already fixed it?
We can help you ask them for confirmation. If they have applied the required PHP fixes and your portal works correctly, you may not need any paid work from us. We help when the update is unclear or older portal code is getting in the way.
Technical details, if you need them.
For you, your hosting provider or whoever looks after the portal. You can contact us without working through this section.
Read the PHP2Shell guidanceThe PHP update, hosting checks and source advisories.
The fix needs to reach PHP itself.
PHP disclosed two critical vulnerabilities on 21 October 2026: CVE-2026-109618 and CVE-2026-109619. They can allow remote code execution without a login. PHP’s advisory covers installations serving web requests.
An application update or temporary WAF rule does not replace the PHP fixes. Confirm the package serving the portal is patched and the relevant services and workers have restarted.
Initial patched releases
- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12
Use a supported, patched release compatible with your platform. Vendors may backport fixes, so the version label alone is not proof. PHP 8.1 and older need a vendor-supported fix or an upgrade path.
PHP’s official advisoryWhere PHP sits in the setup
Magento · WordPress · WooCommerce
Your portal & custom modules
PHP runtime
The layer that needs the security fixes
Does updating WordPress or a security plugin fix PHP2Shell?
The PHP runtime underneath the application needs the fixes. Application updates and temporary WAF rules do not replace that update. Your site and its extensions may also need compatibility changes to run correctly on the patched runtime.
What if Magento modules require an older PHP version?
We check the versions supported by your exact platform release and modules, then agree a compatible path with your host. This may involve module changes, a platform upgrade or a vendor-supported patched package. The newest PHP release is not automatically compatible with every store.
Guidance checked 23 October 2026. Confirm current guidance and package updates with your hosting provider.