PHP2Shell: did the patch reach the process serving your site?
Inventory needs to reach the PHP instance processing requests. Connect packages, execution mode and active processes while separately investigating the earlier period.
Leggi in portogheseBy Pentesty
Two reports, one runtime decision
Reports on attempts before disclosure and emergency fixes prompted this combined analysis. On October 21, the PHP project published fixed versions for CVE-2026-109618 and CVE-2026-109619: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Updating is the complete solution; configuration measures cover only specific paths.
Execution mode changes the relevant conditions
The CVE-2026-109618 advisory confirms remote execution in mod_php before application code and considers PHP-FPM susceptible, without a demonstrated complete exploit for that mode. For CVE-2026-109619, requests must reach the same worker; the validated FPM path depends on a suitable application operation.
Use these differences to formulate questions for the supplier and operator. Identify the assessed service’s execution mode, extensions and configuration. A framework name or homepage test leaves these conditions unanswered. The team needs to know which environment supports its decision and which aspects still require confirmation from the responsible owner.
Connect the package, process and web service
Choose a priority application and follow the request path to the component executing PHP. Record the server, image or package, process set and accountable owner. Link the version information collected to the instance serving traffic, including services managed by third parties and any dependencies outside the team’s direct administration.
The PHP notice directs users to distributions and LTS suppliers for backported fixes. Request the complete package identifier and its mapping to both CVEs. The OpenSSL update analysis complements verification of the component in use; here, the PHP process executing each application also matters to the acceptance decision.
Agree with operations how to replace persistent processes and verify their state after the change. Include replicas, pools and images used during recreation. Each exception needs an owner, a review condition and evidence distinguishing completed installation from an effectively updated service, with any unverified portion of the deployment clearly identified.
Give temporary controls a deadline and evidence
If updating depends on another team, record the approved temporary restriction and the part of the exposure it is intended to reduce. Consult the corresponding technical advisories and assess availability impact. This analysis does not prescribe removing memory limits or treating one configuration change as proof of remediation across the environment.
Verify the legitimate function that must remain available and who monitors changes in supplier guidance. The WAF control review helps distinguish compensating blocking from updating. A favorable result at an entry control should remain linked to the outstanding runtime remediation task and its accountable owner until the correction is verified.
Investigate the period before publication
On October 21, Amazon reported a MadPot attempt observed on October 17 and additional attempts on October 21. It did not determine whether those attempts would have succeeded against real-world systems. It recommended investigating from at least October 17, rather than automatically treating disclosure as the beginning of the relevant period.
Preserve available records and document their time coverage. Correlate process, request and change evidence with authorized maintenance, referring suspicious findings to incident-response owners. Current package state and the analysis of earlier activity need their own outcomes. Collection gaps should remain explicit so another reviewer can understand the limits of any conclusion.
Close the change using a verifiable sample
In an authorized environment, use fictional data and a normal application operation to confirm continuity after updating. Include uploads or background processing when they belong to the legitimate function. Reproducing exploitation or provoking memory exhaustion is unnecessary to demonstrate package delivery and service state within this assessment, whose sample and observation conditions should be recorded.
- Origin: applicable advisory and corrected package or image identification.
- Execution: service, examined processes and verification time after the change.
- Continuity: legitimate operation, observed result and acceptance owner.
- Open issues: unchecked replicas, limitations and investigation of earlier activity still underway.
October 23 update: a specific session-related open issue
Editorial update: October 23, 2026
According to PHP’s October 23 notice, CVE-2026-115560 depends on php_binary or php_serialize in session.serialize_handler, switched to php through ini_set() before session_start(), with upload progress enabled. For that combination, it recommends session.upload_progress.enabled=0 until the next regular bugfix release, without naming a version. Retain that measure if already applied.
Keep the delivery record for the earlier fixes and open a specific verification task for the new notice. Ask the application owner to connect effective configuration with code behavior. A version screenshot alone does not answer that question. If analysis is incomplete, record applicability as pending, with an owner and deadline for examining the remaining components.
If the temporary measure enters the assessment scope, coordinate its application with operations and check legitimate functionality using synthetic data. Retain evidence for each service and process, avoiding a conclusion that all replicas were checked based on one sample. Follow the next official notice before replacing the open issue with a claim of definitive remediation.
October 26 update: check the Windows rebuild and Brotli
Editorial update: October 26, 2026
The official Windows packages received the -1 suffix, such as 8.5.12-1. The package SBOM lists Brotli 1.2.1, whose fixed release addresses CVE-2026-111497. Runtime and source code remain unchanged.
Check whether the application’s HTTP client decompresses external responses along the assessed path. The cURL documentation shows that applications can enable automatic response decompression. Imperva demonstrated RCE on Node.js 24.22.0/Linux arm64, succeeding on some attempts; that result does not validate exploitation in PHP for Windows.
To accept the change, connect the package, architecture, TS/NTS variant and published cryptographic identification to the service executing it. Retain the deployed artifact identifier and confirm the dependency in the corresponding inventory. The main version number alone does not distinguish these rebuilds. Repeat a legitimate operation with a compressed response, using a controlled origin and data, after planned process replacement.
Keep the earlier fixes, session-related open issue and investigation of the earlier period separate. If an HTTP client depends on decompression, record its effective configuration and owner before changing behavior. Any temporary restriction needs a continuity check and deadline; it does not demonstrate remediation of every path.
Frequently asked questions
Does updating WordPress or Laravel complete remediation?
The task must reach the PHP runtime. Connect the update to the instance processing the service and confirm its dependencies separately.
Does using PHP-FPM eliminate the risk?
The advisories describe different conditions for each flaw. Identify the actual mode and application, consult the details and apply the corresponding fix.
Do MadPot attempts prove my company was breached?
No. Amazon’s telemetry does not establish compromise of your environment. A conclusion requires your own evidence, observation period and collection limitations.
What evidence supports closing the update task?
Connect the corrected package, processes in use and legitimate functionality. Record coverage and exceptions; investigation of earlier access retains its own decision and accountable owner.
Sources and references
- PHP: October 21, 2026 advisory and fixed releases
- PHP GHSA-w8hw-w9fx-j79w: CVE-2026-109618 conditions
- PHP GHSA-6wmf-4rv5-p3rp: CVE-2026-109619 conditions
- Amazon: MadPot attempts observed from October 17
- Cyber Security Brazil: editorial news reference
- Cyber Security Brazil: editorial news reference
Original Pentesty analysis, published October 22, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.