Patching PHP2Shell

Last night we patched around 60 servers for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), a pair of brutal 9.2-rated vulnerabilities. When we started I hadn't seen a POC, and I didn't imagine it was far behind. It wasn't. There's one out now, and it looks easy enough to use.

According to the PHP2Shell write-up, it's two flaws in PHP itself. One corrupts memory when PHP runs out of memory, and the other leaves stale state behind that carries over into later requests. Together, they let an attacker run code as the PHP worker or read what's in memory, such as passwords, tokens and API keys, without logging in. Because it's in PHP itself, it doesn't matter how secure your own code is.

The fix landed on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

For us the fix wasn't on the servers themselves. Everything runs in Docker on php:8.4-fpm, and that tag picked up 8.4.27 as soon as it was released:

FROM php:8.4-fpm

So the first job was rebuilding our base image in Buddy, making sure it pulled the new image and didn't use an old cached copy. A quick check that we'd got the right one:

docker run --rm php:8.4-fpm php -v

From there it was a case of cascading our releases in Buddy so every service rebuilt on the new base image and went out again. That matters because of the way it worked: any older workers were still vulnerable.

All servers, including my own, are patched now, but as this was an AI-assisted discovery, let's hope we don't get more of these more often.