Operations | Monitoring | ITSM | DevOps | Cloud

Open source projects are facing a bug detection apocalypse. With thousands of reports flooding in, developers must distinguish between critical system vulnerabilities and downstream issues that don't require an immediate patch.

The PHP2Shell vulnerability triggered a massive cybersecurity crisis. But the real story isn't just about the PHP security flaw. It's about who broke the rules, who was responsible, and whether one controversial decision made everything worse. In October 2026, researchers uncovered critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that threatened websites and applications across the internet. As security teams scrambled to prepare patches, the coordinated disclosure process began falling apart.

Bryan Peace Leon Adato break down what exactly security-minded IT folks - whether they work in SRE, dev, networking, or more esoteric disciplines - should do when a new, critical, apocalyptic vulnerability is announced. They walk you step by step through research, analysis, and how to protect your company if a patch isn't out yet. Along the way they muse about the nature of the industry, the sudden spike in CVEs, and where to find the best hard cidr to take the edge off.

PHP2Shell let attackers run code on PHP servers without logging in, and updating a CMS or its plugins didn't help. Only a new version of PHP fixed it. In this explainer, we break down how the two flaws work (CVE-2026-109618 and CVE-2026-109619, both rated 9.2 critical) and what Upsun Cloud did between PHP's one-day warning and the fix. We get into.