If you have a website, a customer portal, or a vendor-hosted app, you probably have PHP somewhere in the mix. Most of the time, that’s fine.

PHP2Shell changes the urgency. These two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are being treated as “drop everything” issues because they can allow unauthenticated remote code execution on affected PHP versions.

Here’s a practical checklist you can run as an owner or ops lead, even if you don’t write code.

First, understand what you’re trying to protect

You’re not trying to “patch PHP” in the abstract. You’re trying to protect the systems that make you money, move work forward, or handle sensitive data.

Make a short list of business-critical web things. If you only do one step today, do this.

  • Revenue paths. Your main website (especially forms), ecommerce checkout, quoting portals, booking systems.
  • Customer and partner access. Any portal where someone logs in to view invoices, projects, tickets, documents, or dashboards.
  • Internal operations. HR portals, time tracking, intranet sites, reporting dashboards, line-of-business web apps.
  • High-trust integrations. Anything that connects to your accounting system, CRM, payment processor, or single sign-on.

Write down, for each item: the URL, who owns it (vendor, your dev agency, internal), where it’s hosted (if you know), and who you call when it breaks.

Inventory where PHP actually exists (it’s more places than you think)

PHP can show up in obvious places (a WordPress site) and in less obvious ones (a vendor appliance with a web admin page).

Use this quick inventory approach.

  • Start with your domains. List every public domain and subdomain you use (for example: www, portal, app, help, staging). Include old ones you “might still need”.
  • Ask marketing and sales. They often own landing pages, microsites, and form tools that IT never sees.
  • Check for “shadow web apps”. Department tools that started as a quick fix, like a small vendor portal used by your warehouse or finance team.
  • Include vendor-hosted systems. Even if it’s “SaaS”, you still need a vendor answer on whether their stack is affected.

If you have a managed IT provider, this is also the moment to ask them for a simple list of all internet-facing web servers and reverse proxies they manage for you.

What to ask your web developer, hosting provider, or MSP (copy and paste)

You’re trying to get to a clear yes or no, plus a concrete plan. Here are the questions that force clarity.

  • “Which of our sites or apps run PHP, and where?” You want names and URLs, not “probably none”.
  • “What PHP version is each one using today?” This matters because the fixed versions are specific.
  • “Are we using OS packages or custom-compiled PHP?” The patch path is different for each.
  • “What’s the patch plan and the deadline?” Ask for a date and time window, plus who’s doing the work.
  • “After patching, what will you restart to make the fix take effect?” With PHP, updating files is not always the same as running the updated code. You want them to explicitly include service restarts (for example PHP-FPM and the web server) and verification.

If you’re dealing with a vendor, add one more.

  • “Please confirm in writing whether you were affected by CVE-2026-109618 / CVE-2026-109619, and when your production systems were remediated.” Save the response in your vendor folder.

The versions you’re aiming for (and what “patched” means)

For PHP2Shell, the PHP project released fixed versions on October 21, 2026. For most businesses, the simplest target is “at least the fixed patch level” on your current branch.

  • PHP 8.5.x: move to 8.5.12 or later.
  • PHP 8.4.x: move to 8.4.27 or later.
  • PHP 8.3.x: move to 8.3.36 or later.
  • PHP 8.2.x: move to 8.2.35 or later.

If you’re on older PHP branches, you need a real conversation. Some environments may rely on vendor backports, some may require an upgrade project, and some may be “replace the app” situations.

  • Do not accept “we updated the app” as proof. You want confirmation of the PHP runtime version actually running on the server.
  • Do not accept “we applied the patch” without verification. Ask how they confirmed the live runtime version after the maintenance window.

Emergency risk reducers while you patch (useful, but not a substitute)

Sometimes you can’t patch everything in a day. Maybe a vendor needs to do it, maybe a legacy app needs testing, maybe you have a change freeze.

Here are practical steps that reduce exposure while you work the patch plan.

  • Put internet-facing admin pages behind access controls. If a site’s admin login is exposed to the whole internet, restrict it (VPN, allowlist, identity-aware proxy). This is especially important for control panels and management interfaces.
  • Turn on WAF protection where you already have it. If you use a web application firewall (Cloudflare, Azure WAF, a managed WAF through your host), ask your provider what rules or mitigations they’ve enabled for PHP2Shell, and whether anything needs to be tuned for your traffic.
  • Reduce what the web server can touch. Confirm file permissions follow least privilege. A web process should not be able to edit application code, write to random directories, or access secrets it doesn’t need.
  • Watch for obvious signs of exploitation attempts. Ask your MSP to temporarily increase monitoring for suspicious web requests and unusual process behaviour on affected hosts, and to keep logs available for investigation.

These steps buy time. They don’t remove the underlying risk, and they don’t change the fact that vulnerable PHP versions need to be updated.

After you patch, do two quick checks so you can sleep

A patch window that ends with “I think it’s fine” is how problems linger.

  • Version verification. Have your developer or MSP confirm the running PHP version for each site (not just what’s installed on disk). Capture it in a ticket or change record.
  • Basic functional test. Log in, submit a form, run a checkout, generate a PDF, whatever “normal” looks like for that app. Patching is supposed to be boring. A five-minute smoke test keeps it that way.

Want a second set of eyes?

PHP2Shell is a good example of why web apps need an owner-friendly inventory and a repeatable patch routine, not a scramble every time a big CVE drops.

If you would like help building a complete inventory of business-critical web apps, confirming PHP exposure, and coordinating patching and verification, the Flexnet Networks team can help you run it end to end.

Sources