PHP2Shell explained: blocked 22 hours before the patch existed

PHP2Shell let attackers run code on PHP servers without logging in, and updating a CMS or its plugins didn't help. Only a new version of PHP fixed it.

In this explainer, we break down how the two flaws work (CVE-2026-109618 and CVE-2026-109619, both rated 9.2 critical) and what Upsun Cloud™ did between PHP's one-day warning and the fix.
We get into:

How one failed request leaves memory behind that the next request can turn into a shell
Why edge firewall rules were blocking attacks about 22 hours before the patch, and why that isn't a fix
How PHP was rebuilt and redeployed without touching anyone's code or configuration
How PHP 7.2 to 8.1 got backported fixes, and who still needs to upgrade
What to check on your own projects, on Upsun Cloud and everywhere else you run PHP

Chapters

0:00 A PHP flaw plugin updates can't fix

0:16 How PHP2Shell works

0:39 Blocked at the edge before the fix existed

0:57 About 1,700 attacks an hour

1:11 Patching PHP without touching code

1:30 Older PHP versions: backports and outreach

1:49 What to check on your own projects

Check your version and read the full rollout details: https://developer.upsun.com/posts/releases/critical-php-security-patches-upsun-rollout-and-what-to-check
📖 Related reading: How Upsun handled PHP2Shell: https://upsun.com/blog/php2shell-upsun-response/
Learn more at https://upsun.com

The vulnerabilities were found and responsibly disclosed by Wiz Research, OpenAI Codex Security and Calif. PHP share of websites: W3Techs, 28 October 2026.

#Upsun #PHP #WebSecurity #DevOps #CyberSecurity