PHP2Shell terms, version 2026-10-24

Two ways to buy

The estimate in the request form never charges anything and is never binding. Sending the request form is free and carries no obligation. Quoted work: you send your details, a person replies with advice and a fixed quote, and you pay only after you agree to it. The $99 check and patch is a package and works as described under Prices. Packages: you choose a fixed package, accept these terms and pay on Stripe Checkout.

The work

For the one site you name: we find the PHP version and server setup, save a copy of the PHP and web server settings we touch, move the site to a fixed release on its current supported branch (8.2 to 8.5), restart what needs restarting (this can briefly interrupt your site, so we agree a time with you first), check that the site responds afterwards and that the pages and functions we list in the written scope still work (we record each one before and after the change), and send a short written note.

We install a PHP build that carries the fix for PHP2Shell (CVE-2026-109618 and CVE-2026-109619): either the fixed release from the PHP project or your host's or distribution's patched package. Where your host controls PHP, we select the patched version your host offers. If none of them carries the fix, we say so in writing. The note names the build, the old version, how we confirmed the fix, and the checks we ran. The scope always lists your home page, your login, and any form or checkout page you name. You can add any function you name in writing before work starts. Unless the written scope says otherwise, the change is made on your live site. Anything not listed is not tested. One site per request unless we agree otherwise in writing.

Prices

The $99 always buys the check. Supported version and standard setup: patch included. Anything more gets a fixed quote, agreed first, and is never charged above $99 without agreement.

The $99 always buys the check and verification of your PHP and setup. The check is a written report of your PHP version, your setup and what it needs. If you are already on a supported version with a standard setup and no feature migration is needed, the patch is included in the $99 and nothing more is due. If you are on an older or unsupported version, or your setup needs extra work (a feature migration, compatibility changes, anything that adds time), we tell you first and give a fixed quote for the extra before doing any of it. You are never charged more than $99 without agreeing to that quote. A standard setup means one PHP site on one host, where the PHP version can be changed through the hosting panel, php-fpm or the package manager, with no custom-built PHP extensions and no code changes needed. We tell you in writing, after the check, which side you are on, with the reasons.

If you say no to a quote, you keep the check results and the written note. The price in your written confirmation is the price you pay. Extra sites or changed scope are quoted in writing before we start them. A written quote is valid for 7 days from the day we send it. You can also buy the migration review for older PHP.

Packages

Quick package, $99: Always covers the check and verification of your PHP and setup. The patch is included on PHP 8.2 to 8.5 with a standard setup. Anything more gets a fixed quote first. Covered by our posted terms.

Three-sites package, $239: The same for up to three sites on one hosting account. The fee terms under The fee apply to the $239 as they do to the $99.

Migration review, $199 per site: A written plan and fixed quote to move your site off outdated PHP. The fee counts toward the move if you go ahead within 30 days of the plan.

The three-sites package has one scope confirmation for all three sites, and the logic under Prices applies to each site: the check is always covered, the patch is included for each site on a supported version with a standard setup, and any site that needs extra work gets a fixed quote first. The migration review does not include doing the migration itself. After we deliver the migration review plan, the $199 fee is non-refundable. It is credited toward the migration if you go ahead with us within 30 days of the plan, and otherwise it stays paid for the plan you received. The quick and three-sites packages exclude older PHP, a move to a new branch, and repairs to plugins or custom code.

Not included

A malware scan or security audit. Repairs to plugins, themes, custom code, email, payments or other site features, unless the written scope says so. Fixing sites that already break on a newer PHP because of old plugins or custom code (we tell you what breaks and can quote that as separate work). Cleaning up a site that was already compromised. Anything your host controls and will not let us change. Hosting or bandwidth costs.

If our change breaks something

If, within 10 business days of our note, our change breaks a function listed in the written scope, tell us and we restore the previous PHP version and the saved settings at no charge within 1 business day of your report (within 1 business day of your host allowing it, if your host needs a ticket). The 10 business days count from the day after we email our note to the address you gave us. If you did not get the email, tell us and we resend it and the 10 days start again. We treat a failure of a listed function inside that window as caused by our change unless we show you in writing that it was not. If the new PHP exposes a problem in old plugins or custom code, we tell you what breaks, restore the previous version at no charge if you want it, and can quote repairs as separate work.

When work starts

We take a limited number of sites per week. If we are full, we say so and give you a date. We aim to reply within two business days. Business days are Monday to Friday, Eastern time, except US federal holidays. Work starts only after we confirm the scope with you in writing, you confirm the backup, and you give us the access it needs. Work starts when we email you that we have begun the check. We then aim to finish within two business days. These are targets, not guarantees. Hosts that need a ticket on their side can take longer, and we tell you.

Payment

Packages: you pay by card on Stripe Checkout and tick that you accept these terms first. Quoted work: the written quote states the price, when it is due and your cancellation rights, and these terms apply to anything the quote does not change. You agree to a quote by replying yes by email from the address you gave us, or by paying the link. We email you one Stripe payment link for the exact amount, after you agree to the written scope and price. For quoted work, nothing is charged automatically or before you use that link. Stripe emails your receipt. Each written quote names the version of these terms in force on the day we send it.

What you confirm

You tell us that you own the site or are authorized by its owner to have this work done, and that you have cleared it with your host where needed. You are responsible for any permission we need from your host or other third parties. Before we start, you confirm in writing that you have a current backup of your files and database that you can restore. If we cannot see a workable way back, we may decline the work.

Access

We ask for the least access the job needs and name the method in the written scope. Send access details only that way, never through the request form, a chat or the body of an email. We never ask for a password in plain email. We use access only for the agreed work on the named site, keep what we see confidential, and delete the details when the work ends. We tell you in writing when we have deleted your access details, and we delete them no later than 10 business days after our note. Access can expose your site data: we look only at what the change needs and do not copy it off your server. If we learn of unauthorized access to your details, we tell you within 3 business days. AI tools only see our own scripts and notes. Your access details, passwords, files and database contents never go into any AI service. You should also remove our access and change any password you shared.

The fee

The $99 fee pays for the PHP2Shell check itself, and you pay it whether or not you accept any follow-up quote. By paying you ask us to start the check right away. Once the check is delivered the fee is non-refundable. If you are a consumer in the EU or UK, you acknowledge you lose your 14-day cancellation right once the check is fully performed. If you cancel before then, you pay only for the work already done.

If the site looks already compromised

If during the check the site looks already compromised, we stop and tell you in writing what we saw. We do no further work. Cleanup is separate work, and we quote it only if you ask.

Limits on our liability

Our total liability for this service is limited to the fee you paid. This limit never reduces the free restore described in these terms. We are not liable for lost profit, lost data, downtime or other indirect loss. Neither limit applies to our fraud, gross negligence, willful misconduct, misuse of access details or breach of confidentiality, or where the law does not allow it. Patching removes a known flaw. We do not warrant against other vulnerabilities, a future attack, or damage that happened before we started. Backups are your responsibility.

Who we are, and changes

This service is provided by DX DEV INC, a Florida corporation. DXDEV is its brand. The laws of the State of Florida apply. Questions: [email protected]. What we keep: your site address, your email, the written scope and our note, to run the job and answer questions, normally for no more than 90 days after the work ends. Stripe handles your card and we never see the card number. The request form is sent through Web3Forms. The terms shown when you pay (packages) or accept the written scope (quotes) apply to that order, and we will not change them for that order without your written agreement.

What you tick at checkout

Quick package: I ask DX Dev to start now and agree the $99 fee is non-refundable once the check is delivered (Terms).

Three-sites package: I ask DX Dev to start now and agree the $239 fee is non-refundable once the check is delivered (Terms).

Migration review: I ask DX Dev to start now and agree the $199 fee is non-refundable once the plan is delivered (Terms).