Service terms

The terms that govern paid work, in plain language. Operated by Valentin Iosif, trading as Kollaz (PHP2Shell Fix), Ottawa, Ontario, Canada. Contact: support@kollaztoolz.com.

Version dated October 25, 2026.

1. What the service is

PHP2Shell Fix is a PHP patch-status review and remediation service for CVE-2026-109618 and CVE-2026-109619. The free check is a review of available patch evidence. It is not a full security audit, penetration test or certification, and no review or patch can guarantee that a site will never be attacked.

2. Offers and prices

  • Standard PHP patch: CA$197 per eligible site (US$149 where the USD offer applies).
  • Legacy migration: from CA$349 (from US$249). This is a starting price; the final fixed price is confirmed in writing after assessment and before work.
  • Aftercare: CA$49 per month per site (US$35), optional, and cancellable at any time. Aftercare is monitoring: we watch the PHP version your site announces and its patch status for the reviewed critical fixes, and alert you when a new critical fix makes your version fall behind. It is available after a completed job, and also as a standalone service to any site owner who wants that watch, with no prior job required. Aftercare does not include patching work; if patching is ever needed, it is quoted separately in writing before any work.

3. Sequence of a job

  1. You request the free check and receive a written finding.
  2. Where work is needed, you receive a written scope and a fixed price.
  3. You accept the scope in writing.
  4. You pay through a secure hosted Stripe payment page. Card details never pass through this site or email.
  5. You provide temporary access for the agreed work only.
  6. We take and confirm a full backup before any change, apply the patch or migration, run the agreed tests, and document the verification record.
  7. You receive the verification record, and the temporary access is revoked.
  8. Aftercare, if wanted, is agreed separately; it can start after a job is complete, or on its own as a standalone monitoring service.

4. Eligibility

  • The standard patch covers sites on supported PHP branches (8.2 and newer) that can take the branch security update on their existing hosting.
  • Legacy migration covers sites on PHP 7.4, 8.0 or 8.1 where no vendor patch evidence is available, subject to a staging compatibility assessment.
  • Sites on fully managed platforms (for example Shopify, Wix, Squarespace, WordPress.com) are not eligible, because the provider controls the runtime. The provider's written confirmation is the right route there.
  • Eligibility is confirmed by the free check before any payment. An ineligible site is told why, in writing, with no charge.

5. Exclusions

  • Suspected compromise cleanup: assessed and scoped separately before any work; a patch alone is not a cleanup.
  • Pre-existing breakage, unrelated updates, redesign or content work.
  • Compatibility rework beyond the items itemized in your written migration scope.
  • Hosting, domain or third-party licence fees.

6. Payment, guarantee, and no refunds

Payment is made in advance, after written scope acceptance, through the hosted Stripe payment page. Payment is final and there are no refunds.

The guarantee is the documented work itself, bounded by your written scope. It consists of three commitments: (1) the scope and fixed price are confirmed in writing before any work; (2) a full backup is taken and confirmed before any change; (3) the work itemized in your scope is performed, the agreed checks are run, and you receive the documented verification record at handover. If an upgrade cannot be completed safely, the confirmed backup is restored: that returns your site to service and counts as a restoration, not a completed patch, and the next step is agreed with you in writing. There is no promise beyond the written scope and these commitments.

7. Access and backups

Access is requested only after scope acceptance and payment, is limited to what the work needs, and is revoked at handover. You are responsible for your own ongoing backups outside the job backup taken under section 3.

8. Liability

Conclusions are stated exactly as strongly as the evidence supports, using the wording on the guide page. Nothing in these terms promises immunity from attack. Liability for a job is limited to the amount paid for that job.

9. Changes to these terms

These terms are dated and versioned on this page. The version in force when you accept a written scope is the version that governs that job; later edits never apply retroactively to an accepted scope.