Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) let attackers run code on your server without logging in. Fixed-fee audit, compromise check and safe upgrade.
PHP2Shell Audit & UpgradeOverview
Michael Marquez works with teams on architecture, security, and engineering discipline, drawing on three decades of production experience and the systems built at Crumby Labs, including Bitcrumb and Tapin Wallet. That includes helping teams think clearly about where AI-assisted development helps and where it needs a human decision in front of it, the same case made in AI Is Not Your Architect.
Services
Blockchain
Protocol design and implementation, from consensus and identity to token systems, grounded in production work on Bitcrumb.
Distributed & Scalable Systems
Clustering, consensus, service decomposition, and fault-tolerant architecture for systems that need to keep working and keep growing.
Web & Mobile Applications
Full-stack architecture for production web and native mobile apps, including key management and encrypted storage where it matters, drawing on Tapin Wallet.
Augmented AI Engineering
Architecture discipline for teams building with AI coding tools, the practice behind AI Is Not Your Architect.
Security Consulting
Security review and threat modeling for systems handling identity, keys, or anything else that can't be quietly compromised.
Code Migration
Moving an existing codebase from one language or stack to another without losing what already works.
Team Building & Training
Structuring engineering teams, hiring guidance, and workshops based on the methodology in AI Is Not Your Architect.
PHP Security Audit & Upgrade
Exposure audit, compromise check, safe upgrade and hardening for legacy PHP sites. Details on PHP2Shell.
How an Engagement Works
Every engagement starts with a free 30-minute call so I can understand what you are trying to do, what you already have, and what is worth your money. From there I send a written scope with a fixed fee: exactly what I will do, which systems I will touch, and the dates. Nothing starts until you have approved it in writing.
I work with the least access I need, through accounts you create and remove, and I never ask for your passwords. When the work is done you get a plain-English report of what I found, what I changed and what remains. To get started, use the form below and I will reply by email to set up the call.