Patch critical PHP vulnerabilities
Budget / SalaryA$80–130
TypeFreelance project
LocationRemote
Posted1 hour ago
Patch critical PHP vulnerabilities (PHP2Shell / CVE-2026-109618 & CVE-2026-109619) on Zen Cart server
We run a Zen Cart e-commerce store currently on PHP 8.2.28. We need an experienced server/DevOps engineer to apply the official PHP security patch for the two critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and confirm the server is no longer exposed. These are unauthenticated remote code execution flaws being actively exploited, so this is time-sensitive.
Scope of Work
Review the current hosting setup and how PHP is installed (managed host, VPS package, or custom build).
Update PHP from 8.2.28 to the patched release 8.2.35 (the fix on the 8.2 branch), staying within the 8.2 line so no application-level changes are needed.
Restart PHP-FPM / web server so all workers run the patched binary.
Verify the store loads and core functions work after the update (homepage, product pages, cart, checkout, admin login).
Confirm the patched version is live (e.g. via php -v and the Zen Cart admin Server/Version Info page).
Advise on any interim mitigations (e.g. WAF rules) if the patched build cannot be applied immediately.
What This Project Is NOT
This is not a Zen Cart version upgrade or code migration. We are staying on the same PHP minor branch, so no Zen Cart core files, templates, or plugins should need changes. If you believe otherwise, flag it before doing any work.
Requirements
Demonstrated experience with PHP version management on live servers (cPanel/Plesk, or apt/yum, or compiled PHP).
Familiarity with PHP-FPM / Apache mod_php restarts and verifying patched builds.
Awareness of the PHP2Shell advisory and the patched release numbers.
Deliverables
PHP updated to 8.2.35 (or later 8.2.x) and verified live.
Short written confirmation of the before/after PHP version and the steps taken.
Store confirmed functional post-patch.
Before Starting
Take a full backup or server snapshot before applying the update.
We run a Zen Cart e-commerce store currently on PHP 8.2.28. We need an experienced server/DevOps engineer to apply the official PHP security patch for the two critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and confirm the server is no longer exposed. These are unauthenticated remote code execution flaws being actively exploited, so this is time-sensitive.
Scope of Work
Review the current hosting setup and how PHP is installed (managed host, VPS package, or custom build).
Update PHP from 8.2.28 to the patched release 8.2.35 (the fix on the 8.2 branch), staying within the 8.2 line so no application-level changes are needed.
Restart PHP-FPM / web server so all workers run the patched binary.
Verify the store loads and core functions work after the update (homepage, product pages, cart, checkout, admin login).
Confirm the patched version is live (e.g. via php -v and the Zen Cart admin Server/Version Info page).
Advise on any interim mitigations (e.g. WAF rules) if the patched build cannot be applied immediately.
What This Project Is NOT
This is not a Zen Cart version upgrade or code migration. We are staying on the same PHP minor branch, so no Zen Cart core files, templates, or plugins should need changes. If you believe otherwise, flag it before doing any work.
Requirements
Demonstrated experience with PHP version management on live servers (cPanel/Plesk, or apt/yum, or compiled PHP).
Familiarity with PHP-FPM / Apache mod_php restarts and verifying patched builds.
Awareness of the PHP2Shell advisory and the patched release numbers.
Deliverables
PHP updated to 8.2.35 (or later 8.2.x) and verified live.
Short written confirmation of the before/after PHP version and the steps taken.
Store confirmed functional post-patch.
Before Starting
Take a full backup or server snapshot before applying the update.
Apply on Freelancer →
Project sourced from Freelancer.com. Applications happen directly on the original platform — we never collect your data.