PHP2Shell: What Should You Patch Now?
By Chuck Lerch, Founder and CEO, Cyberuptive ·
Update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or a vendor-confirmed patched package, and verify the running web workers (PHP security announcement). Investigate exposure before the October 21 disclosure: Amazon observed an exploitation attempt on October 17 (Amazon Threat Intelligence). Configuration changes reduce specific attack paths but do not fully fix both PHP2Shell vulnerabilities.
The PHP project released emergency security fixes on October 21, 2026 for CVE-2026-109618 and CVE-2026-109619, two Common Vulnerabilities and Exposures identifiers associated with unauthenticated remote code execution (PHP security announcement). Amazon Threat Intelligence reported attempts against its MadPot sensors before public disclosure (Amazon Threat Intelligence). Internet-facing PHP services need both update verification and an exposure review.
What are the key takeaways?
- The PHP project identifies web-serving deployments, including PHP-FPM and Apache mod_php, as in scope (PHP security announcement).
- Fixed branches are 8.5.12, 8.4.27, 8.3.36, and 8.2.35 (PHP security announcement).
- Amazon’s pre-disclosure telemetry describes attempts, not confirmed compromise of every exposed server (Amazon Threat Intelligence).
- Do not treat a web-filter rule or one configuration change as complete remediation (PHP security announcement).
Which systems should your team inventory?
Inventory the PHP runtime behind each web service, including packaged applications, containers, and provider-managed hosting. The PHP advisory covers installations serving web requests through several deployment modes, not only one framework (PHP security announcement). Ask application owners to identify what actually serves production traffic.
Our recommendation is to record the service, runtime branch, package source, hosting owner, update method, and exposure period. Include inactive images or deployment templates that could reintroduce an old runtime during rollback. Avoid publishing a diagnostic PHP information page to the internet just to collect version evidence.
| PHP branch | Fixed release in the announcement |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
These versions come from the PHP project; distribution packages may use vendor backports, so obtain the package vendor’s fix confirmation (PHP security announcement).
What do the vulnerabilities change?
The advisory describes one flaw involving memory exhaustion and partially initialized request data, and another involving stale internal state reused by a later request on a worker (PHP security announcement). Both can enable unauthenticated remote code execution, meaning an attacker may run code without first obtaining an application login (PHP security announcement).
The PHP project says updating is the only complete solution and that configuration mitigations address specific paths rather than making an installation safe (PHP security announcement). Do not improvise memory-limit changes across production: review the official guidance and application availability consequences with the platform owner.
What should happen this week?
Prioritize installation of the fixed runtime and validation of the running service. The following is our recommended operational checklist based on the PHP advisory and Amazon’s response guidance (PHP security announcement) (Amazon Threat Intelligence).
- Assign each service an update owner. Separate self-managed systems from hosting where the provider controls the runtime, and request deployment evidence rather than a generic assurance.
- Install the fixed package or confirmed backport. Follow the platform’s supported process and verify that the workers handling requests use the corrected runtime (PHP security announcement).
- Test the application’s essential workflows. Our suggested checks cover authentication, uploads where used, background processing, and error handling, using approved test data.
- Review earlier exposure. Amazon recommends beginning investigations from at least October 17 rather than assuming October 21 was the first possible attack date (Amazon Threat Intelligence).
- Track exceptions explicitly. Record interim controls, business impact, owner, and the next patch checkpoint. A temporary filter is not the final resolution (PHP security announcement).
What evidence should investigators examine?
Amazon recommends reviewing suspicious web requests, unexpected process execution, and file modification on application servers (Amazon Threat Intelligence). Its guidance includes investigating POST uploads containing the PHP_SESSION_UPLOAD_PROGRESS string, while treating observations in the context of the application (Amazon Threat Intelligence).
Preserve relevant proxy, web-server, application, and host records before routine retention removes them. That is our evidence-management recommendation; the available records will determine what can be concluded. Distinguish a suspicious request from evidence that code actually executed.
Amazon says its technical analysis was ongoing and that the success of some observed attempts on real-world systems was unclear (Amazon Threat Intelligence). The appropriate response is urgent investigation with calibrated conclusions, not a blanket declaration that every exposed PHP deployment was breached.
How would our SOC coordinate the response?
Our U.S.-based security operations center (SOC) would maintain separate tracking for patch verification, historical exposure, and investigation findings. We would work with application owners to avoid confusing a successful package installation with a complete incident review.
Use managed patch management, the patching-versus-investigation guide, and the SOC pricing guide to define the handoff between platform maintenance and security response.
What else should buyers and operators know?
Which PHP versions contain the fixes?
The announced fixed releases are 8.5.12, 8.4.27, 8.3.36, and 8.2.35; package vendors may supply backports (PHP security announcement).
Can a configuration-only workaround fix both flaws?
No. The PHP project and Amazon say updating is the only complete remediation (PHP security announcement) (Amazon Threat Intelligence).
Did exploitation attempts predate disclosure?
Amazon reports an October 17 attempt in MadPot telemetry, before the October 21 public disclosure (Amazon Threat Intelligence).
Does an attack request prove compromise?
No. Amazon distinguishes observed attempts from confirmed success (Amazon Threat Intelligence). Review host and application evidence before making a compromise determination.
What is the next step for your organization?
Bring your scope, current evidence, and unresolved responsibilities to a focused discussion. Schedule a security review or Call 833-92-CYBER to clarify the next practical actions.