Same-day response to the critical PHP2Shell flaw: defense in depth and zero downtime
Following the disclosure of critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 (severity 9.2 out of 10) in the PHP engine, we applied immediate edge protection, verified 7,559 files with zero errors, and updated all four PHP branches across development, testing, and production without taking a single site offline.
On October 21, 2026, the PHP project disclosed two critical vulnerabilities in the language engine itself, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, severity score 9.2 out of 10). They allow an attacker to execute code on the server without logging in, in a single request, before any site code runs. With working exploits circulating on the day of the announcement, cybersecurity agencies including the UK NCSC advised taking offline anything that could not be protected right away.
At Conn2Flow, triage, network shielding, and the full update across development, testing, and production were completed on the very same day, without a single customer site going offline.
1. Immediate triage and network edge shielding
Within minutes of the disclosure, we mapped the PHP version running in each environment. Because public package distribution mirrors were overloaded and delayed during the first hours, we enforced immediate network-layer protection:
- Sites began accepting traffic exclusively through our edge protection layer (WAF), which already filtered the known attack patterns for this flaw.
- Administrative access to the infrastructure was restricted.
- Customer sites remained 100% online throughout the entire operation.
2. Development environment and 7,559 verified files
As soon as the patched official container images were published, we updated the development environment with pinned safe versions to prevent accidental regression. Before touching downstream servers, we checked 7,559 files across the system for compatibility: zero errors.
3. Test environment validation and production update
Using the package maintainer's official upstream source, we updated all four active PHP branches in our test environment (8.2.35, 8.3.36, 8.4.27, and 8.5.12) and validated all 10 test sites one by one—every single one online with zero errors.
Once validated in testing, we applied the same definitive update across the PHP engines serving our production sites and verified each domain. We encourage every team running PHP to confirm that their servers are already on 8.2.35, 8.3.36, 8.4.27, or 8.5.12 (or newer).
Source: Core · REQ-290 · BATCH-298