# PHP2Shell response checklist

Free, independent guidance from PatchPHP. Reviewed 22 October 2026.
This is a manual response aid, not a vulnerability scan or a security certification.

## Start with official guidance

- PHP advisory: https://www.php.net/archive/2026.php#2026-10-21-5
- CERT-EU: https://cert.europa.eu/publications/security-advisories/2026-018
- CVE-2026-109618: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
- CVE-2026-109619: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

PHP released upstream fixes on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. All PHP installations serving web requests require attention. Distribution/LTS vendors may supply backported fixes; check the exact vendor advisory and installed package, not just the upstream version string. For PHP 8.1 and older, consult your vendor or plan an upgrade. Minimal source backports are linked from PHP's advisory for selected old branches; applying those correctly requires specialist judgment.

Only an appropriate update completely fixes these vulnerabilities. Temporary mitigations do not make an installation safe. If immediate patching is not possible, follow official guidance on isolation with the responsible administrator.

## 1. Identify affected environments

- [ ] Inventory production, staging, containers and applications embedding PHP.
- [ ] Map each application to its actual runtime, server or container image.
- [ ] Include every instance and worker pool; identify a responsible owner.
- [ ] Record unknown systems and follow up rather than assuming they are unaffected.

## 2. Confirm the web runtime and vendor guidance

- [ ] Verify the PHP runtime actually serving web requests. `php -v` checks the CLI runtime only and may differ from PHP-FPM or Apache.
- [ ] Ask your hosting provider or distribution vendor for the relevant patched package and advisory.
- [ ] Do not expose a public phpinfo page, credentials or configuration data.
- [ ] Check that each environment has the applicable security fix, accounting for vendor backports.

## 3. Plan recovery and apply updates

- [ ] Confirm backups, restore procedures and application recovery requirements.
- [ ] Stage and test the appropriate official release or vendor patch where feasible.
- [ ] Distinguish a routine security update from a major runtime migration or application compatibility project.
- [ ] Agree on the production change and any necessary maintenance window.
- [ ] Deploy the patched runtime across all affected instances and restart or replace relevant workers using your vendor's instructions.

## 4. Verify deployment and application health

- [ ] Re-check the runtime/package serving requests after deployment and restart.
- [ ] Check all affected nodes, pools, images and replacement/restart paths.
- [ ] Test login, checkout, uploads, forms, background jobs and other business-critical paths as applicable.
- [ ] Watch errors and availability. Escalate failed checks. Avoid silently rolling back to a vulnerable public-facing runtime; any emergency recovery needs an isolation plan.

## 5. Investigate suspicious activity

- [ ] Preserve relevant application, web server and infrastructure logs.
- [ ] Escalate unexpected files, new accounts, unusual processes or suspicious outbound activity to an incident response specialist.
- [ ] Keep incident containment and evidence preservation separate from routine patching.
- [ ] Remember that updating PHP does not reverse an earlier compromise.

## 6. Document the outcome

- [ ] Record assets, runtime/package versions, vendor evidence, deployment time and test results.
- [ ] List remaining unknowns and unresolved systems with an owner.
- [ ] Communicate verified facts and limitations to stakeholders.
- [ ] Define responsibility for future security updates.

## Need help?

Use the contact form at https://patchphp.com/contact for a paid pilot or scoped legacy assessment. Do not email passwords, private keys, tokens or customer data.

PatchPHP is independent and is not affiliated with the PHP project or government agencies. Review the official advisories for updates after the date above.