The operator
PHP2Shell Fix is operated by Valentin Iosif, in Ottawa, Ontario, Canada, trading as Kollaz. There is no call centre and no hand-off chain: the person who answers your request is the person who does the work and signs the verification record.
Contact: support@kollaztoolz.com. We reply within 1 business day.
What this service is
- A patch-status review for CVE-2026-109618 and CVE-2026-109619, based on evidence, ending in a conclusion the evidence supports.
- Remediation where needed: branch security updates, and planned migrations off end-of-life PHP, each under a written scope and fixed price.
- Documented verification at the end: before and after versions, checks run, and the record you keep.
What it is not
- Not a full security audit, penetration test, or certification. A patch record covers the two reviewed CVEs only.
- Not a compromise cleanup service. Suspected compromise is assessed and scoped separately before any work.
- Not affiliated with the PHP project, WordPress, Joomla or Drupal, and not a hosting provider. We cannot patch a runtime your platform provider controls.
How work is done
All work is remote. Temporary access is arranged only after you have approved a written scope and paid through the hosted Stripe payment page, and it is revoked when the job is handed over. A confirmed backup precedes any change. If an upgrade cannot be completed safely, the backup is restored and that is reported as a restoration, never dressed up as a completed patch.
Honesty rules the service runs on: a version not being visible is not proof of protection; a host's marketing claim is not patch evidence; and where the evidence does not settle a question, the conclusion says "more information required" and payment is not the answer to an unproven problem.