programmatic
Discuss a project

Critical PHP Security Advisory · Updated October 22, 2026

Emergency PHP2Shell patching and PHP security remediation.

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known collectively as PHP2Shell, can permit unauthenticated remote code execution under affected runtime conditions. We assess exposure, deploy the correct updates and verify your applications keep working.

Request an emergency assessmentExplore the approach

Inside the delivery

How we handle a critical PHP vulnerability

A controlled path from identifying exposure to a documented remediation, prioritizing controlled deployment over unsupported guarantees. Where infrastructure supports rolling deployments, load balancing and health checks, disruption may be minimized; single-server systems or incompatible dependencies may require a maintenance window.

Reference approachAdapted during discovery
  1. 01

    Discover and inventory

    Identify PHP runtimes, PHP-FPM, Apache and alternative servers, operating-system distributions, containers and publicly accessible services.

    Output

    An infrastructure inventory with exposure

  2. 02

    Assess and prepare

    Verify affected components, confirm available upstream fixes and vendor backports, then review dependencies, backups and a rollback procedure.

    Output

    A prioritized, controlled deployment plan

  3. 03

    Remediate

    Apply suitable security updates through a controlled change process, rebuilding container images and replacing affected runtimes where required.

    Output

    Updated, patched environments

  4. 04

    Verify and follow up

    Check running PHP versions and patch status, validate critical application functionality and document outstanding risks.

    Output

    Validation results and a remediation report

Controls across the workflow

  • Backups and a prepared rollback path
  • Controlled change process
  • Application functionality validation
  • Interim network and endpoint restrictions where patching is blocked

Decisions that shape the scope

What if we cannot patch immediately?
If a hosting provider has not released the necessary packages, delaying without a risk-reduction plan is not sound. Interim steps may include restricting internet access to affected endpoints, isolating vulnerable servers, disabling nonessential services, reviewing edge security controls and increasing monitoring while urgent patch delivery is coordinated with the vendor. Temporary controls do not replace the official PHP security updates.
How is downtime managed?
Where infrastructure supports rolling deployments, load balancing and health checks, service disruption may be minimized. Single-server systems or incompatible application dependencies may require an agreed maintenance window.
Is a version string enough to confirm safety?
Not always. Some Linux distributions provide security fixes through backported patches, so a version string alone may not establish whether a vendor-maintained package remains vulnerable. We confirm against vendor advisories.

Before you commit

Is this the right engagement?

You operate PHP-powered infrastructure and need to confirm PHP2Shell exposure, deploy the correct CVE-2026-109618 and CVE-2026-109619 updates and verify that critical applications keep working.

What we need from you
The affected application URL, hosting environment (AWS, DigitalOcean, cPanel, Laravel Forge, Docker or other), PHP version if known, access arrangements and a description of the issue.
How you accept the work
Running PHP versions reflect the fixed upstream or vendor-backported release, patch status is verified and critical application functionality is validated in the target environment.
Scope & alternatives
This engagement remediates runtime exposure and verifies applications. Confirmed compromise investigation, ongoing operations and broader hardening are scoped separately from the emergency patch work.

Overview

Reduce exposure while protecting production availability

For businesses operating PHP-powered applications, the immediate challenge is identifying vulnerable environments, deploying the correct security updates and verifying that critical applications continue working. Our engineering-led approach focuses on reducing security exposure while managing production availability and application compatibility risks.

  • 01Identify vulnerable PHP runtimes across production infrastructure
  • 02Apply PHP2Shell security updates to supported PHP installations
  • 03Validate Laravel, WordPress and custom PHP application compatibility
  • 04Remediate PHP environments on AWS, DigitalOcean and Linux servers
  • 05Update PHP Docker images and containerized applications
  • 06Investigate suspicious activity and support incident response
  • 07Establish safer PHP patch management and deployment procedures

Capabilities

Our PHP security patching services

Select the remediation that matches your environment. Responsibilities and acceptance criteria are agreed before work begins.

01

Emergency PHP2Shell vulnerability assessment

Before updating production servers, teams need to understand which components are exposed. The deliverable is a prioritized assessment identifying affected components and recommended remediation steps.

  • Production and staging PHP runtime inventory
  • PHP-FPM, Apache and alternative runtime identification
  • Operating-system distribution and patch status
  • Publicly accessible PHP applications and services
  • Containers, worker processes and dependent infrastructure
  • Vendor-maintained security fixes and support status
02

PHP runtime security patching

Updating production PHP installations requires more than running an upgrade command, because patch deployment may affect extensions, dependencies, workers or runtime configuration. The deliverable is a documented patch deployment and verification summary.

  • Confirm affected runtime and installed packages
  • Check security updates and vendor advisories
  • Review dependencies, backups and rollback path
  • Deploy through a controlled change process
  • Verify PHP version and patch status
  • Validate critical application functionality
03

Laravel PHP security updates

Laravel applications depend on the installed PHP runtime and surrounding infrastructure; upgrading Composer dependencies does not independently remediate a PHP runtime vulnerability. The deliverable is a PHP runtime remediation plan with Laravel compatibility verification.

  • PHP and Laravel version compatibility
  • Composer platform requirements
  • Laravel Forge-managed infrastructure
  • Nginx and PHP-FPM configuration
  • Redis, queues and scheduled jobs
  • Deployment and rollback procedures
04

WordPress and WooCommerce server security

An updated WordPress installation can still depend on a vulnerable server-side PHP runtime, and owners on managed hosting may lack permission to install PHP updates directly. The deliverable is a hosting and application security remediation assessment.

  • Hosting PHP version and patch status review
  • PHP-FPM or alternative runtime verification
  • WordPress and WooCommerce compatibility testing
  • Plugin and theme compatibility checks
  • Hosting provider coordination
  • Post-update functionality testing
05

AWS, Linux and Docker remediation

PHP environments can be distributed across virtual machines, container images and managed infrastructure. The deliverable is infrastructure-specific remediation recommendations and deployment verification.

  • EC2-hosted PHP applications on Ubuntu or Debian
  • Nginx and Apache web stacks with PHP-FPM
  • Official and custom PHP Docker image rebuilds
  • Docker Compose and container dependency review
  • Laravel Forge and DigitalOcean-hosted applications
  • Containerized PHP runtime verification

How we work

From discovery to a documented remediation

01

01

Discovery

Identify PHP runtimes, workloads and exposure across production and staging to produce an infrastructure inventory.

02

02

Assessment

Verify affected components and the security fixes available for each, including vendor-maintained backports, to produce prioritized findings.

03

03

Preparation

Review backups, application dependencies and rollback options to produce a controlled deployment plan.

04

04

Remediation

Apply suitable security updates through a controlled change process to produce updated environments.

05

05

Verification

Check patch status and application health to produce validation results against the agreed criteria.

06

06

Follow-up

Document findings and outstanding risks to produce a remediation report, including any interim controls still in place.

Comparison

The PHP Security Team released fixes for two critical vulnerabilities on October 21, 2026. A version string alone may not establish whether a vendor-maintained package remains vulnerable.

PHP branchFixed upstream versionRecommended action
PHP 8.28.2.35Apply the relevant security update
PHP 8.38.3.36Apply the relevant security update
PHP 8.48.4.27Apply the relevant security update
PHP 8.58.5.12Apply the relevant security update
PHP 8.1 and olderNo current upstream security releaseVerify vendor-supported backports or plan migration

Scroll horizontally to view the full comparison on smaller screens.

Integrations

Environments we remediate

Hosting, runtime and container platforms we commonly patch and verify.

AWS EC2
DigitalOcean
Laravel Forge
Docker
Nginx
Apache mod_php
PHP-FPM
cPanel

Further reading

PHP2Shell explained: FBI & NSA guidance, affected versions and an emergency action plan

Read the guide

Inside the guide

  • 01What PHP2Shell is and why CVE-2026-109618 and CVE-2026-109619 are critical
  • 02What the FBI, NSA, Canadian Centre for Cyber Security and CERT-EU actually recommend
  • 03Which PHP versions are affected and how to verify the runtime serving live traffic
  • 04A practical emergency action plan for CTOs and infrastructure teams

Frequently asked questions

PHP2Shell questions answered

01

Can PHP2Shell affect a fully updated Laravel application?

Yes. Updating Laravel packages does not automatically update the PHP runtime serving the application, and the runtime is where the vulnerability lives.

02

Can an updated WordPress website still be vulnerable?

Yes. WordPress and the underlying PHP runtime are updated separately in many hosting environments, so the site can be current while the server runtime is not.

03

Can PHP2Shell be fixed through Cloudflare?

A web application firewall may provide supplementary protection against certain attack patterns, but it is not a complete replacement for installing the official PHP security updates.

04

Do I need to rebuild my Docker containers?

If the image includes vulnerable PHP components, you need a patched image and a deployment that replaces the affected runtime. Rebuilding an image without updating the PHP components is insufficient.

05

Will PHP patching cause downtime?

Downtime depends on the hosting architecture, compatibility requirements and deployment approach. A controlled deployment can reduce disruption, but zero downtime cannot be guaranteed for every environment.

06

How do I know whether my PHP server is compromised?

Patch status does not prove a system was never compromised. Investigating suspected exploitation may require reviewing historical logs, unexpected processes, unauthorized files, account changes and outbound connections.

07

Do you support US businesses?

Programmatic LLC can assess inquiries from US and international businesses. Engagement scope, availability, timing and deployment arrangements are confirmed before work begins.

Related

Related security and engineering services

Service

Security Testing

Explore

Service

DevSecOps

Explore

Service

Application Support & Maintenance

Explore

Service

Containerization (Docker & Kubernetes)

Explore

Service

Cloud Migration

Explore

Engineering team

Hire PHP Developers

Explore

Engineering team

Hire DevOps Engineers

Explore

Start a conversation

Request an emergency PHP security assessment

Critical PHP vulnerabilities require a technically verified response, not guesswork. Share your environment and we will assess or remediate PHP2Shell exposure. You can also email info@programmatic.llc.

Request security assessmentSchedule a discussion