Emergency WordPress Malware Removal & Security Services

Different software, different fix, both critical. wp2shell is in WordPress core — CVE-2026-60137 and CVE-2026-63030, scored 9.8 by Wordfence, affecting WordPress 6.9 through 7.0.1. You patch it yourself by updating WordPress to 7.0.2, 6.9.5, or 6.8.6. php2shell is in PHP — CVE-2026-109618 and CVE-2026-109619, rated 9.2, affecting every PHP version back to 5.4. Your host patches that one. Fixing one does not fix the other.

If you are running WordPress 6.9 through 7.0.1, yes, to the full remote code execution chain. If you are on the 6.8 branch, you are affected by the SQL injection half of it. Check your version at the bottom-right of any admin screen. Update to 7.0.2, 6.9.5, or 6.8.6 — and then verify the update actually completed, because auto-updates fail silently more often than people expect.

Safe from wp2shell, not from php2shell. Those are two separate problems in two separate pieces of software. Updating WordPress closes the core flaw. The PHP flaw sits underneath WordPress and needs your host to update the interpreter. Check both — Tools, Site Health, Info, Server will show you your PHP version. And if patching was delayed on either, review the server for backdoors rather than assuming you got there first.

Almost certainly, unless your host has already patched. CVE-2026-109618 and CVE-2026-109619 affect every PHP version back to 5.4. Researchers at Wiz demonstrated working remote code execution against a current, fully updated WordPress install, so being up to date on WordPress itself does not protect you. Check your PHP version in Tools, Site Health, Info, Server — if it is below 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and your host has not confirmed a backported patch, you are exposed.

Our emergency response team initiates triage within 15 to 30 minutes of receiving access credentials. Complete file sanitization, backdoor removal, and site restoration are typically finalized within 2 to 6 hours.

You cannot fix it from inside WordPress. It is patched at server level by updating PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or by installing your host's patched package. On managed hosting, open a ticket and ask them to confirm which PHP build you are on. On a VPS or dedicated server it is a package update plus a worker restart. Avoid any plugin claiming to fix it — the flaw is in the interpreter and no plugin can reach it.

Yes. Every cleanup comes with a 100% Malware Removal Guarantee backed by a 30-day anti-reinfection warranty. If malware returns within 30 days, we re-audit and clean it free of charge.

PHP 8.1 and older are past end of life and get no official patch. Some hosts backport security fixes to older branches, so ask yours directly. If they have not, your realistic options are migrating to PHP 8.4 or 8.5, which may need plugin and theme compatibility work, or taking the site offline until you can. We handle these migrations, including the compatibility testing that stops a PHP upgrade from breaking your site.

The specific signs for this vulnerability are unusual multipart requests followed by memory-limit errors in your logs, abnormally large PHPSESSID cookies, and PHP worker processes restarting for no clear reason. More general signs are unfamiliar admin users, modified core files, unexpected outbound requests, and new scheduled tasks. If any are present, treat the server as compromised and rotate every credential it held.

It watches behaviour rather than matching signatures. A signature scanner finds known malware files, which means it finds yesterday's attacks. Behavioural monitoring flags a pattern — a file changing at an odd hour, a login from an unusual location followed immediately by a plugin install, a sudden change in outbound traffic — and alerts before anything matches a known signature. It also produces far fewer false alarms, which matters because alert fatigue is why most monitoring gets ignored.

Most sites are patched the same working day once we have server access. The work itself is quick; the care goes into checking plugin and theme compatibility and having a tested rollback ready before we touch anything. If your site is on PHP 8.1 or older and needs a version jump, allow two to five days for compatibility testing.

A one-off audit and patch is a fixed project fee based on how many sites and what state they are in. Ongoing monitoring runs as a monthly retainer, priced per site, covering patch management, integrity checks, uptime monitoring, and incident response. We quote after looking at your setup — a single brochure site and a WooCommerce store with twelve integrations are not the same job.

Yes, and most of our security work is exactly that. We audit the existing setup first, including host, PHP version, plugin stack, and file permissions. Occasionally the honest answer is that a site has been neglected so long a rebuild costs less than remediation, and we will tell you if that is the case rather than billing you for months of patching.

Yes. Shopify is hosted, so the PHP flaw does not apply, but Shopify stores have their own exposure — third-party apps with excessive permissions, theme code injection, and checkout tampering. We cover that on our Shopify security page.

No. We create an offsite system backup and forensic snapshot before taking any remediation actions. Cleaning targets malicious code signatures and unauthorized files without affecting legitimate content or customer data.

If your site is reinfected through the same entry point we identified and closed, we clean it again at no charge within 30 days of the original cleanup. That is a warranty on our work.

It does not cover a new compromise through a different vector — a plugin vulnerability disclosed after we finished, a password shared with someone outside your team, or a fresh zero-day in WordPress core. Those are new incidents and we quote them as new work.

The distinction matters because it tells you what the warranty is worth. A warranty covering everything forever would not be a warranty, it would be marketing copy.