Incident response

PHP2Shell is now on CISA's exploited list. Patch PHP by Oct 29 and check for a break-in before you restart (CVE-2026-109618, CVE-2026-109619)

How to fix CVE-2026-109618: upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart every worker. CISA added both PHP2Shell bugs to KEV on Oct 26 with an Oct 29 deadline and forensic triage, so save logs and the process list before the restart.

HOL GuardOct 26, 2026