Three conversations that decide whether a fix is real

Subject: PHP2Shell patch confirmation for [domain or account reference]

Hello [provider] support,

I am the [role] responsible for [domain / account reference]. I am reviewing our exposure to the PHP vulnerabilities disclosed on 21 October 2026 (CVE-2026-109618 and CVE-2026-109619, fixed upstream in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12).

Please confirm the following for every environment that serves or has served our site, including staging, preview and any legacy node still in DNS:

1. The exact PHP version now running under the web SAPI (not the CLI version), and the package source or image digest.
2. Whether PHP-FPM, Apache mod_php, php-cgi, FrankenPHP or another SAPI is used.
3. The date and time the updated runtime was installed.
4. Confirmation that every old PHP worker process was restarted and is no longer serving traffic. A package installation alone does not confirm this.
5. Any interim PHP settings currently applied, such as memory_limit, post_max_size, session.upload_progress.enabled, or fatal_error_backtraces.
6. Whether any of our environments remain on a branch older than 8.2.35, or rely on a backport. If so, the vendor advisory or backport reference.
7. The best contact for a follow-up if our own verification does not match your answer.

A short written answer with the version, source and restart confirmation is enough. I am not asking for customer data or configuration secrets.

Thank you,
[Name]
[Role]
[Contact details]

Subject: PHP2Shell handover: [system name], [date]

SYSTEM
Name: [system name]
Owner: [team or role]
Environment: [production / staging / other]
Public entry points: [domains or service names]

RUNTIME
SAPI: [FPM / mod_php / other]
Previous version: [version and package source]
Patched version: [version and package source, or image digest]
Nodes or replicas changed: [list]
Workers restarted: [how and when]
Rollback artefact: [package version, image digest or snapshot reference]

EVIDENCE
Package or image check: [command or console path, output location]
Running process or digest check: [how it was checked, output location]
Traffic confirmation: [how we know the patched workers serve requests]

REGRESSION
Checks completed: [list the business paths tested]
Result: [pass / pass with exceptions]
Failing checks and owner: [list or “none”]

RESIDUAL RISK
Interim settings still applied: [list or “none”]
Systems not yet patched: [list, reason, target date and owner]
Intrusion review status: [not started / in progress / completed; scope]

NEXT ACTIONS
[Action] — owner [name] — due [date]

HANDOVER
Prepared by: [name]
Accepted by: [name]
Date: [date]
Evidence stored at: [path or ticket]

Subject: PHP2Shell status: [scope], [date]

WHAT CHANGED
PHP published fixes for two critical remote code execution vulnerabilities on 21 October 2026. The patched upstream versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. A separate session upload progress issue (CVE-2026-115560) was described in an informational advisory on 23 October.

SCOPE
[Number] systems are in scope. [Number] are confirmed patched and verified. [Number] are patched but not yet verified. [Number] remain unpatched, with the reason and target date below.

WHAT IS DONE
[One line per completed item, with the evidence type: package version, image digest, worker restart, regression test.]

WHAT IS NOT DONE
[Unpatched systems, interim settings still in place, intrusion review status, ownership gaps.]

RISK STATEMENT
A patch removes the specific vulnerability only after the running web workers use the patched version. We have [not] confirmed that. We have [not] reviewed for signs of prior exploitation. A WAF or interim configuration reduces exposure but is not a substitute for the patch.

DECISION NEEDED
[For example: approve a maintenance window for two legacy systems; accept a documented residual risk until a date; authorise an intrusion review.]

NEXT CHECKPOINT
[Date] — [what will be reported].

Owner: [name]
Evidence: [ticket or record reference]