{"id":728,"date":"2026-10-21T18:30:00","date_gmt":"2026-10-22T01:30:00","guid":{"rendered":"https:\/\/rainier-it.com\/blog\/?p=728"},"modified":"2026-10-21T12:45:50","modified_gmt":"2026-10-21T19:45:50","slug":"patched-php-servers-same-day","status":"publish","type":"post","link":"https:\/\/rainier-it.com\/blog\/patched-php-servers-same-day\/","title":{"rendered":"Patched PHP Servers: How We Handled PHP2Shell"},"content":{"rendered":"\n

We patched PHP servers the same day the PHP2Shell fix came out on Oct. 21, 2026. Attackers were already testing the bug, so we moved fast and checked our work as we went.<\/p>\n\n\n\n

Our earlier alert<\/a> told you what to do. This post shows what it looked like from the inside, and how we were secure, fast. You can copy the steps whether you run one website or a few.<\/p>\n\n\n\n

If your site sits with a hosting company, you can mostly relax. You just need to ask them a question, and we cover it below.<\/p>\n\n\n\n

What PHP2Shell is and who is affected<\/h2>\n\n\n\n

PHP is the programming language behind a huge share of websites. Sansec<\/a> says two critical bugs, CVE-2026-109618 and CVE-2026-109619, let an attacker run code on a web server without logging in. Both are rated 9.2 on the CVSS v4.0 scale, which tops out at 10.<\/p>\n\n\n\n

The flaws are in PHP itself, not in your website’s code. Sansec<\/a> says researchers showed attacks working against WordPress, Drupal, Joomla, Nextcloud and other well-known PHP apps.<\/p>\n\n\n\n

Sansec also reports that Cloudflare saw early attacks at 7:43 a.m. UTC on Oct. 21, hours before the 2 p.m. UTC release. watchTowr<\/a> says details leaked online on Oct. 20 and that it sees exploitation in the wild.<\/p>\n\n\n\n

Product<\/th>Affected<\/th>Fixed<\/th><\/tr><\/thead>
PHP 8.5<\/td>Before 8.5.12<\/td>8.5.12<\/td><\/tr>
PHP 8.4<\/td>Before 8.4.27<\/td>8.4.27<\/td><\/tr>
PHP 8.3<\/td>Before 8.3.36<\/td>8.3.36<\/td><\/tr>
PHP 8.2<\/td>Before 8.2.35<\/td>8.2.35<\/td><\/tr>
PHP 8.1 and older<\/td>Affected<\/td>No fix from the PHP project; ask your vendor for a backport or upgrade<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The versions come from the PHP project’s announcement<\/a>.<\/p>\n\n\n\n

How we patched PHP servers in about an hour<\/h2>\n\n\n\n

By late morning we had a list of every PHP install across our servers. It took minutes, not days. Every one was on a vulnerable version. That list is the reason the morning stayed calm.<\/p>\n\n\n\n

Next we sorted the list by what faces the internet. Those went first.<\/p>\n\n\n\n

Before changing anything, we looked for signs someone had already got in. We checked for web shells (small hidden files that give an attacker remote control), stray PHP files in upload folders, and tampered WordPress settings. We found none. The odd traffic in our logs was ordinary password-guessing on WordPress logins, not this exploit.<\/p>\n\n\n\n

Then we took a snapshot of each server. A snapshot is a saved copy of the machine as it is right now, so we could undo any patch in seconds.<\/p>\n\n\n\n

Our WordPress sites, our file-sharing server’s container image and our test copies were patched within about an hour. We used the security packages from the Linux distributions, such as Debian’s DSA-6574-1<\/a> and Ubuntu’s USN-8948-1<\/a>.<\/p>\n\n\n\n

We did not trust the version number alone. Distributions often fix a bug without changing PHP’s headline version. Ubuntu’s fix for its older 22.04 release, for example, is a build of PHP 8.1. So for each package we read the changelog to confirm the CVE fix was listed.<\/p>\n\n\n\n

Then we restarted the PHP workers. A patched file on disk does nothing until the running program reloads it. Last, we checked that every site answered normally.<\/p>\n\n\n\n

When you can’t patch yet<\/h2>\n\n\n\n

One third-party app had no fixed version from its vendor yet. We still had to protect it.<\/p>\n\n\n\n

Sansec’s stopgap is to block multipart\/form-data requests, the format browsers use to upload files. Sansec<\/a> says every known trigger uses it. Our proxy now rejects those requests for that app.<\/p>\n\n\n\n

The cost is that the app loses its upload feature for a few days. We think that trade is worth it. Sansec warns the rule can also break some forms, so test after you add it, and remove it once the real fix is in.<\/p>\n\n\n\n

PHP’s own notes<\/a> say partial measures reduce exposure but do not make an install safe. Only the update does.<\/p>\n\n\n\n

One more catch from PHP: if you installed PHP from the volunteer-run Remi repository, it had no update on Oct. 21. Switch to your distribution’s packages or build from source.<\/p>\n\n\n\n

Our take<\/h2>\n\n\n\n

This is our view, and you may see it differently. We think the fix itself was the easy part. The hard part is knowing what you run and getting in front of it before it bites you.<\/p>\n\n\n\n

A small office doesn’t need fancy tools for that. A simple list of your websites, who hosts them and what PHP version each uses turns a scary morning into routine work. We’d also take a small, reversible trade, like losing uploads for a few days, over leaving a door open while waiting on a vendor.<\/p>\n\n\n\n

What to do this week<\/h2>\n\n\n\n