When a PHP2Shell-class vulnerability lands: find every affected runtime across your AWS accounts, patch and roll it, shield what can't move today, and check whether you were already hit. In days, not weeks.
2–10 days
$5k–$15k
October 21, 2026 brought PHP2Shell — two unauthenticated remote-code-execution flaws in PHP 8.2–8.5, exploited for four days before they were public — alongside ten Node.js fixes and a compromised LiteLLM release. Days like that are now normal, and the teams that cope are the ones who can answer "where do we run this?" in minutes. We get you through the current incident and leave you able to do the next one yourself.
Inventory every runtime and image affected, across every account and region: Amazon Inspector, ECR scanning, SBOMs, and your infrastructure code
Upgrade, rebuild and roll — Beanstalk platforms, container images, Lambda layers and runtimes, EC2 packages — and verify each one is actually running the fixed version
Isolate anything on an end-of-life version until it can be upgraded
AWS WAF managed rule groups in front of anything that can't be patched today
Log and process hunting from the first known exploitation date, not the disclosure date
Credential rotation and rebuilds where indicators turn up; CloudTrail review for misuse
A maintained runtime inventory, scheduled image rebuilds, managed runtime updates where they fit, and an hour-scale patch runbook
Every affected system patched or isolated, with evidence
A written assessment of exposure and any compromise found
The inventory, pipelines and runbook to handle the next one yourselves
Tell us about your current environment and goals. We'll review the details and respond with a proposed engagement structure and timeline.
Typical response time: 1–2 business days.
Prices and timelines are estimates for typical engagements, not offers. Scope, price and terms are set in a written agreement after we understand your situation. Terms of use.