Independent response guide

Respond to PHP2Shell. Know what is done.

Two critical PHP runtime flaws were fixed upstream on 21 October 2026. This kit takes you from an unknown runtime to a recorded handover — and separates a real patch from a green dashboard.

Start your assessment Open the response workbook

Reviewed 24 October 2026. Sources are linked on every operational page. Independent publication; not affiliated with PHP, any security vendor or any government agency.

The path

Four steps, four things you should be able to show

Each step produces an artefact. If you cannot show the artefact, the step is not finished — even if the change window closed and nothing caught fire.

Step 01

Assess

List what actually answers HTTP, the SAPI it runs and who owns it.

Output: A runtime inventory with owners

Step 02

Patch

Apply the right update for your package source and restart every worker.

Output: A fixed runtime with no old workers

Step 03

Verify

Collect package, process, traffic and business evidence — in that order.

Output: Evidence that the running service changed

Step 04

Hand over

Record what is done, what is not, and who accepts the residual risk.

Output: A handover another person can audit

Checked 24 October 2026

Current confirmed state — and its limits

Upstream patch scope PHP released 8.2.35, 8.3.36, 8.4.27, 8.5.12 on four supported branches. Distribution packages can be fixed by a backport with a different version string; use the vendor notice, not a bare number.
A patch is live only when every worker runs it Installing a package is not restarting the service. An old FPM master can keep forking old workers. Verify process start times and traffic, not only the package on disk.
Session upload progress remains a caveat PHP’s 23 October informational advisory describes CVE-2026-115560 and recommends session.upload_progress.enabled=0 until the next regular bugfix release. It can affect already-patched releases in an unusual runtime configuration.

Read the scope and evidence · See every source and check date

No green light

This site will not tell you that you are safe.

It cannot see your servers, your logs or your traffic. It does not scan for exploitation, and it does not certify that a compromise did not happen before the patch. What it can do is make your own evidence specific enough to review.

A version claim tells you what is installed, not what is running.
A WAF block is an additional layer; Cloudflare says it does not replace the PHP fix.
A zero test-bug count is not a vulnerability finding.
An interim setting reduces one path; it is not a complete mitigation.

Understand the risk boundary

Choose the path

Start from the environment you actually have

If you are not sure, go back to the assessment. The fastest wrong answer is patching the environment you can see while another one keeps serving.

Managed hosting Your host controls PHP. Ask for the exact web SAPI version and a worker restart — not “latest”. WordPress Core and plugin updates do not patch PHP. Check the runtime, then test the site. Containers A moved tag does not change a running container. Rebuild, replace, confirm the digest.

Definition of done

What counts as complete?

All four. A completed fix count without verification is reported as “Fixes recorded; verification pending”, not as closed.

The runtime serving traffic is updated

Not just installed on disk. The web SAPI version or image digest is recorded. Check how

Old workers and replicas have exited

Process start times or running digests show that no pre-patch worker still serves. Check how

The business regression has passed

There is a verification record

Counts, evidence and known residual items are stored where the next person can find them. Check how

The workbook

Counts you can defend, in a browser you control

One row per business line. Required fixes, completed fixes and open test bugs are separate numbers. The completion rate is total completed divided by total required — never an average of row percentages.

Verification is a human decision: not started, in progress, passed or blocked.
CSV export and print are built in. No account, sync, email or remote save.
Stored in this browser only. Corrupt data is left untouched, not overwritten.

Open the response workbook

Example preview Not a real record

Example workbook rows, clearly fictional
Business	Required	Done	Verification
Example — customer portal	4	3	In progress
Example — public site	2	2	Passed
Example — legacy admin	1	0	Not started

Recorded completion 5 of 7 · 71%

Templates Hosting, handover and management Three short English templates with the questions that produce usable answers. Sources What supports each claim PHP advisories, distribution notices, platform documentation and check dates. Revisions What changed, and when A record of substantive site changes, not a second incident timeline.