PHP2Shell post mortem

On 20 October, php.net announced a security release for the next day, 16:00 CEST. Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both allow remote code execution, and both sit in PHP itself, so they hit before any app code runs. Details leaked on Hacker News the same day. It's all over the news, even classical media reports about it.

# Timeline for us

All times on 21 October, CEST:

• Morning: we make the rollout plan in our daily. First clients get in touch.
• 16:00: the PHP release is out.
• 17:00: a PHP config change on all apps of both platforms blocks the easiest attack path. It does not fix the bug.
• 18:00: the old platform dashboard goes offline until the apps are patched.
• 19:30: the old platform rollout starts, one region after another.
• 21:20: the old platform dashboard is back online.
• 21:45: all apps on the old platform run the patched PHP.
• 23:00: all apps on the new platform run the patched PHP.

Progress went to our status page↗ along the way.

We did not take client websites offline during that time. A few clients asked how to do that themselves, we provided .htaccess examples.

# Delays

The fix was out at 16:00. Our builds could not start right away:

• The new platform uses the official PHP images on Docker Hub. We had to wait until those were updated to be able to build our own images.
• The old platform pulls packages from Ondřej Surý's Ubuntu repository. It was overloaded and answered with errors.
• PECL, the server for PHP extensions, was down for hours, causing slow builds on both platforms.

Many services used for building PHP was overloaded around the world, becasue everybody patched at the same time, of course.

# Old PHP versions

PHP 8.1 and older are past their end of life. This time the PHP maintainers published fixes for these versions as well. We were lucky. These fixes were only published as source code, without a proper release. So the version number stays the same: PHP 8.1 still shows 8.1.34 after the patch. From the outside, a patched old version looks exactly like an unpatched one. Only for 8.2 and up, the version number tells.

Our phpinfo apps on the old platform show what runs there:

• PHP 7.4↗, PHP 8.0↗, PHP 8.1↗: version number unchanged, can not be verified from outside
• PHP 8.2↗: 8.2.35
• PHP 8.3↗: 8.3.36
• PHP 8.4↗: 8.4.27

On the new platform, we disabled PHP 8.1 completely. Only a handful of apps were affected. We upgraded them to PHP 8.2.

Fixes for old versions is not published for all security issues. The next time a risk like this shows up, there may not be any patches for an old version at all. The only safe option is to upgrade the app to a newer PHP version.

So, please upgrade the PHP version of your apps now, when you can still pick the time. We also plan to charge extra for PHP versions past their end of life soon, more on that soon.

# Old platform runtime updates

The rebuild for the patch also brought new extension versions to the old platform. We actually planned this patch for a little later but used the opportunity to smuggle it in:

PHP extensions

• mongodb: 2.2.1 → 2.5.5

Profiling and monitoring

• Blackfire PHP probe: 1.92.60 → 2026.10.2
• Blackfire CLI: 2.30.3 → 2026.10.0
• New Relic PHP agent: 12.5.0.30 → 12.11.0.40

# Learning

We learned a lot. The new platform was easier to patch than the old one: new images, rolled out to all apps. Next time it should not wait on others. Two infra changes are planned for the new platform:

• Install PHP extensions without using PECL.
• Build PHP images from PHP source code, as soon as php.net publishes a release.

We also learned that many clients have not found their way to our two status pages. So we will add a more visible banner to all our pages whenever a maintenance is coming up or under way, and the same for incidents.

# Trivia

• A planned database maintenance on the old platform ran on the same evening, for 495 apps. It finished at 23:56.
• Our post on how to detect and fix a hacked PHP website got way more visits than usual.
• After the release, PHP 8.4.27 and 8.5.12 showed a regression: a crash in SimpleXML (php-src #24488↗). No fix release yet.

We will update this post if required. Thanks to everybody who stayed patient.