Operations | Monitoring | ITSM | DevOps | Cloud

Who Really Screwed Up the PHP2Shell Security Crisis?

Oct 31, 2026 By Harness In Harness
The PHP2Shell vulnerability triggered a massive cybersecurity crisis. But the real story isn't just about the PHP security flaw. It's about who broke the rules, who was responsible, and whether one controversial decision made everything worse. In October 2026, researchers uncovered critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that threatened websites and applications across the internet. As security teams scrambled to prepare patches, the coordinated disclosure process began falling apart.
View Video
nexthink

PHP2Shell Exposed a Bigger Problem. Is Your IT Team Ready for the Next Threat?

Oct 30, 2026 By Vedant Sampath Chief Technology Officer In Nexthink
A critical security vulnerability can put an entire business at risk before IT teams have even established where the problem lies. For CIOs, that means needing immediate answers about which systems are exposed, how essential business services could be affected and how quickly their teams can get ahead of the threat. That was the challenge facing organizations on October 21, when two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, emerged.
Read Post

PHP2Shell explained: blocked 22 hours before the patch existed

Oct 29, 2026 By Upsun In Upsun
PHP2Shell let attackers run code on PHP servers without logging in, and updating a CMS or its plugins didn't help. Only a new version of PHP fixed it. In this explainer, we break down how the two flaws work (CVE-2026-109618 and CVE-2026-109619, both rated 9.2 critical) and what Upsun Cloud did between PHP's one-day warning and the fix. We get into.
View Video
scout

Symfony's October Security Releases: Three Ways a Single Request Can Hurt You

Oct 28, 2026 By Scout Monitoring In Scout
On October 14 and 15, Symfony shipped a coordinated set of maintenance releases across every supported branch: 5.4.54, 6.4.48, 7.4.21, and 8.1.9. Between them they close three CVEs, all rated high severity, and all with the same uncomfortable shape: a single HTTP request, no authentication, no special configuration, and the PHP process either burns a CPU core or falls over.
Read Post
upsun

How Upsun handled PHP2Shell: protection in place 22 hours before the patch

Oct 22, 2026 By Upsun In Upsun
On 21 October 2026, the team behind PHP released an emergency fix for two critical security flaws. PHP is the programming language behind a large share of the web, including WordPress, Drupal and many online stores. Researchers at Wiz named the flaws PHP2Shell. An attacker could use them to take control of a website without ever logging in. Updating a website, its CMS, or its plugins doesn't help. The only real fix is (and was) a new version of PHP itself.
Read Post
logz.io

PHP2Shell: What the Critical PHP Vulnerabilities Mean for Your Servers

Oct 22, 2026 By David Lotan Bolotnikoff In logz.io
TL;DR On October 21, 2026, PHP released emergency patches for two critical flaws known together as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). An attacker with no credentials can use them to run code on a PHP web server, in some cases with a single HTTP request. Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 now. Then go through your logs, because exploitation attempts were recorded before the patch shipped. In this post.
Read Post
haproxy

HAProxy Enterprise WAF protects against PHP2Shell (CVE-2026-109618, CVE-2026-109619)

Oct 21, 2026 By Frank Mancina In HAProxy
On October 20th, 2026, the PHP Security Team issued an advanced notice and security advisory disclosing two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), both rated CVSS v4.0 9.2, affecting PHP installations.
Read Post
InvGate

PHP2Shell: How to Find Vulnerable PHP Versions on Your Devices

Oct 21, 2026 By Ignacio Graglia In InvGate
Last updated: October 21, 2026. We'll update this article as PHP and Linux distributions publish new information. PHP2Shell is the nickname of two critical vulnerabilities in PHP that let an attacker run code on a web server without logging in. PHP released the fixes on October 21, 2026, and IT and security teams now need to know which of their servers and computers run a vulnerable PHP version, so they can patch those first.
Read Post
harness

php2shell: the flaw hiding all across the web

Oct 21, 2026 By Soujanya Namburi In Harness
Discover how php2shell vulnerabilities expose PHP servers to remote code execution and how Harness virtual patching protects endpoints while you deploy fixes. On October 21, 2026, the PHP project rushed out emergency patches for two critical flaws nicknamed php2shell (CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10). This isn't a bug in some plugin or a server someone set up wrong. It's in PHP itself, in the way the language has handled errors since 2012.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.