Installing PHP’s emergency fixes feels like the end of the PHP2Shell scramble. It isn’t.
Researchers and incident responders who spoke with Security Point Break describe a series of false finish lines. They warn organization can reasonably believe they are protected while vulnerable code is still reachable, still running or already exploited.
Related: How two decade-old PHP flaws knocked government sites offline and kicked off a worldwide patching race. A Hidden Flaw in the Web’s Plumbing Set Off a Global Scramble
The PHP project says updating is the only complete fix for CVE-2026-109618 and CVE-2026-109619. Configuration changes can narrow particular attack paths but do not make a vulnerable installation safe. The harder part is proving the update reached everything it had to reach.
You’re Not Safe if the Patch is Installed but Not Running.
Researchers at Echo upgraded a PHP-FPM test server from vulnerable PHP 8.3.12 to patched 8.3.36 and deliberately did not restart it.
Learn moreLearn more about the primary category.
“Even though the new version was installed, HTTP requests were still running on 8.3.12,” Echo researcher Yuval Saggie said. Even newly spawned workers ran the old code, he said, because they inherited it from the original master process.
The fix is to restart or replace every PHP-FPM and Apache worker, then check the version reported by the runtime actually answering a web request – not the package sitting on disk. In clusters, containers and hosting platforms, that check has to cover every instance serving the application.
You’re Not Safe Because a Version Number Says So
Version strings mislead in both directions. Linux distributions and long-term-support vendors often backport security fixes without changing the upstream PHP version number, so a fixed server can look vulnerable and a flagged server can be clean.
“For distributions using backported fixes, the version number alone isn’t enough,” Saggie said. Red Hat said scanners certified through its vulnerability program generally do a better job recognizing its backports than tools that judge exposure on version strings alone.
The lesson: trust the running code, not the label on it.
You’re Not Safe if You Only Patched the PHP You know About
Sonatype tracks about 15 affected PHP packages across 565 versions – a strikingly small number for a flaw touching so much of the web. Dependency data misses most of the footprint, said Garrett Calpouzos, security principal and researcher at Sonatype.
“What’s important here isn’t which packages bundle PHP; it’s which applications run on PHP,” he said.
Jim Sherlock, vice president of AI and cybersecurity R&D at ProCircular, said his firm’s external attack-surface scans have turned up PHP assets customers did not know they had: hosting control panels, help-desk software and old marketing sites built years ago by outside agencies.
You’re Not Safe Until Your Vendors Are
When PHP is embedded in an appliance or service, only the manufacturer can fix it.
Palo Alto Networks says the management web interface in all currently listed PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 versions, along with Panorama, is affected. Fixes are forthcoming; until then, the company recommends limiting management access to trusted internal addresses. Cisco, as of Oct. 22, was still evaluating a long list of products and cloud services and had not confirmed any as vulnerable.
“The ones that worry me most are the consoles that manage firewalls and networks,” Sherlock said. “They control everything underneath them, and customers can’t fix the PHP inside them.”
His advice: ask every vendor whether its product runs PHP, which version and when a fix will ship. “And get it in writing.”
You’re Not Safe Behind a WAF
Cloudflare says it deployed PHP2Shell rules roughly nine hours before public disclosure and watched attackers mutate payloads to slip past them. It still tells customers to patch.
WAF rules are built on known attacker behavior and do not cover every way to reach the underlying flaws, said Scott Miserendino, CTO of DataBee, a Comcast company. They also fail if attackers can skip the WAF and hit the origin server directly, so he recommends locking the origin down to accept traffic only from the WAF or CDN.
The bigger risk, said Andrew Obadiaru, vice president and CISO at Cobalt, is organizational: the stopgap quietly becomes the fix, as happened with many Log4Shell WAF rules.
“A WAF rule should come with an owner, an expiration date, and a ticket that stays open until the actual fix is confirmed in production,” he said.
You’re Not Safe if Someone Got There First
A patch closes the door. It does not evict anyone already inside.
Amazon Threat Intelligence says its honeypots recorded a PHP2Shell exploitation attempt on Oct. 17, four days before disclosure. Matt Hull, vice president of cyber intelligence and response at NCC Group, called Oct. 17 a sensible minimum starting point for reviewing logs — and said organizations with older logs should look further back, because knowledge of the flaws may predate it.
NCC Group has not found confirmed backdoors or webshells tied to PHP2Shell. “We’re seeing reports of active exploitation attempts, but that’s different from evidence of successful compromise,” Hull said. The absence of confirmed break-ins so far is not evidence that a given server was untouched.
You’re Safe When You Can Prove It
Obadiaru said organizations should be able to answer three questions almost immediately when an advisory like this lands: Do we run this? Where? Is it exposed?
“With PHP2Shell, attackers were active before patches shipped,” he said. “Any hours spent searching for affected systems were hours they had and you didn’t.”
By the standards the experts describe, safe means every PHP instance has been found and has a named owner; the fixed runtime is verifiably serving traffic on every one; vendors have shipped fixes or committed to dates in writing; any WAF rule has an expiration date; and logs have been reviewed back to at least Oct. 17. Systems on end-of-life PHP need a retirement plan, said Justin Beals, CEO of Strike Graph, rather than being rediscovered in the next emergency.
Until every one of those is true, “patched” is a status. Safe is something you prove.
