PENTESTY · EDITORIAL ANALYSIS · · 4 min read
PHP2Shell: did the patch reach the process serving your site?
Inventory needs to reach the PHP instance processing requests. Connect packages, execution mode and active processes while separately investigating the earlier period.
By Pentesty
Two reports, one runtime decision
Reports on attempts before disclosure and emergency fixes prompted this combined analysis. On October 21, the PHP project published fixed versions for CVE-2026-109618 and CVE-2026-109619: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Updating is the complete solution; configuration measures cover only specific paths.
Execution mode changes the relevant conditions
The CVE-2026-109618 advisory confirms remote execution in mod_php before application code and considers PHP-FPM susceptible, without a demonstrated complete exploit for that mode. For CVE-2026-109619, requests must reach the same worker; the validated FPM path depends on a suitable application operation.
Use these differences to formulate questions for the supplier and operator. Identify the assessed service’s execution mode, extensions and configuration. A framework name or homepage test leaves these conditions unanswered. The team needs to know which environment supports its decision and which aspects still require confirmation from the responsible owner.
Connect the package, process and web service
Choose a priority application and follow the request path to the component executing PHP. Record the server, image or package, process set and accountable owner. Link the version information collected to the instance serving traffic, including services managed by third parties and any dependencies outside the team’s direct administration.
The PHP notice directs users to distributions and LTS suppliers for backported fixes. Request the complete package identifier and its mapping to both CVEs. The OpenSSL update analysis complements verification of the component in use; here, the PHP process executing each application also matters to the acceptance decision.
Agree with operations how to replace persistent processes and verify their state after the change. Include replicas, pools and images used during recreation. Each exception needs an owner, a review condition and evidence distinguishing completed installation from an effectively updated service, with any unverified portion of the deployment clearly identified.
Give temporary controls a deadline and evidence
If updating depends on another team, record the approved temporary restriction and the part of the exposure it is intended to reduce. Consult the corresponding technical advisories and assess availability impact. This analysis does not prescribe removing memory limits or treating one configuration change as proof of remediation across the environment.
Verify the legitimate function that must remain available and who monitors changes in supplier guidance. The WAF control review helps distinguish compensating blocking from updating. A favorable result at an entry control should remain linked to the outstanding runtime remediation task and its accountable owner until the correction is verified.
Investigate the period before publication
On October 21, Amazon reported a MadPot attempt observed on October 17 and additional attempts on October 21. It did not determine whether those attempts would have succeeded against real-world systems. It recommended investigating from at least October 17, rather than automatically treating disclosure as the beginning of the relevant period.
Preserve available records and document their time coverage. Correlate process, request and change evidence with authorized maintenance, referring suspicious findings to incident-response owners. Current package state and the analysis of earlier activity need their own outcomes. Collection gaps should remain explicit so another reviewer can understand the limits of any conclusion.
Close the change using a verifiable sample
In an authorized environment, use fictional data and a normal application operation to confirm continuity after updating. Include uploads or background processing when they belong to the legitimate function. Reproducing exploitation or provoking memory exhaustion is unnecessary to demonstrate package delivery and service state within this assessment, whose sample and observation conditions should be recorded.
- Origin: applicable advisory and corrected package or image identification.
- Execution: service, examined processes and verification time after the change.
- Continuity: legitimate operation, observed result and acceptance owner.
- Open issues: unchecked replicas, limitations and investigation of earlier activity still underway.
Frequently asked questions
Does updating WordPress or Laravel complete remediation?
The task must reach the PHP runtime. Connect the update to the instance processing the service and confirm its dependencies separately.
Does using PHP-FPM eliminate the risk?
The advisories describe different conditions for each flaw. Identify the actual mode and application, consult the details and apply the corresponding fix.
Do MadPot attempts prove my company was breached?
No. Amazon’s telemetry does not establish compromise of your environment. A conclusion requires your own evidence, observation period and collection limitations.
What evidence supports closing the update task?
Connect the corrected package, processes in use and legitimate functionality. Record coverage and exceptions; investigation of earlier access retains its own decision and accountable owner.
Sources and references
- PHP: October 21, 2026 advisory and fixed releases
- PHP GHSA-w8hw-w9fx-j79w: CVE-2026-109618 conditions
- PHP GHSA-6wmf-4rv5-p3rp: CVE-2026-109619 conditions
- Amazon: MadPot attempts observed from October 17
- Cyber Security Brazil: editorial news reference
- Cyber Security Brazil: editorial news reference
Original Pentesty analysis, published October 22, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.