Reading Wiz and Calif without overgeneralizing
Wiz and Calif explain why request-lifecycle failures can outlive the request that caused them. The official advisory for CVE-2026-109618 demonstrates mod_php RCE; FPM susceptibility is source-based, without a complete demonstrated FPM exploit for that CVE. CVE-2026-109619 separately confirms an application-dependent FPM upload-progress path. Read each GHSA for its precise evidence instead of treating every SAPI as an identical proven exploit.
Wiz ResearchRead the original ↗CalifRead the original ↗Turn the upgrade guide into a deployment checklist
First fixed upstream versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 7.4, 8.0 and 8.1 have exceptional minimal source backports, not ordinary supported releases. For vendor packages, match BOTH CVEs and the full installed revision to the vendor notice. Rebuild containers from a patched base, replace every replica and restart long-running workers. Restarting an unchanged image or checking only CLI PHP is insufficient.
| PHP branch | Upstream releases below | First patched release | Security support ends |
|---|---|---|---|
| PHP 8.5 | < 8.5.12 | ✓ 8.5.12 | Dec 31, 2029 |
| PHP 8.4 | < 8.4.27 | ✓ 8.4.27 | Dec 31, 2028 |
| PHP 8.3 | < 8.3.36 | ✓ 8.3.36 | Dec 31, 2027 |
| PHP 8.2 | < 8.2.35 | ✓ 8.2.35 | Dec 31, 2026 |
No normal PHP project release is available for these branches. Minimal source backports exist for 7.4, 8.0 and 8.1; vendor support must be verified separately. Read guide ↗
What the Foundation and OpenAI articles add
The PHP Foundation describes maintainer effort and security funding; OpenAI’s Patch the Planet article describes coordinated validation, provider preparation and disclosure. Neither is proof that your host has installed a fix. Convert coordination into evidence for your own deployment: an owner, inventory, exact package revision, restart record and post-update verification. Some secondary descriptions of FPM coverage and old branches differ; the PHP GHSA and vendor package advisories take precedence.
PHP FoundationRead the original ↗OpenAI - Patch the PlanetRead the original ↗php -v
php --ini
# Check the executable used by the Web service separately.
php-fpm -v
# On versioned installations, for example:
php-fpm8.3 -vPrimary sources & further reading
PHP security teamRead the original ↗CVE-2026-109618Read the original ↗CVE-2026-109619Read the original ↗Research & practical guides
PHP2Shell tools
Check a public website, review local configuration and logs, or find maintained response tools. Each result explains its evidence and its limits.
01PHP2Shell in plain language
PHP is the engine running your website; WordPress, Laravel and plugins sit above it. Updating a plugin does not update PHP. Two runtime memory-safety flaws can turn abnormal request cleanup into disclosure or code execution. A public website check can find clues, but only the host or server administrator can verify the actual Web runtime and its patch.
02Was it an attempt, or a successful intrusion?
An unusual multipart request or a WAF alert can indicate an attempt. OOM messages, SIGSEGV/SIGABRT and bursts of HTTP 500 can also have ordinary causes. Unexpected PHP child processes, outbound connections, modified files or unauthorized accounts warrant urgent investigation, but attribution still needs evidence. Memory disclosure may leave no webshell or new file. A clean file scan cannot rule it out.
03Preserve evidence before changing the host
Record discovery time, domain, instance, runtime, current symptoms and the last known good state. Export original access/error/WAF and process logs with their timezone; preserve cloud audit records and authorized disk or memory snapshots when available. Store copies with restricted access and hashes. Do not upload cookies, tokens or customer data to public scanners. Avoid clearing logs or deleting suspicious files before evidence is captured.
04Reading Wiz and Calif without overgeneralizing
Wiz and Calif explain why request-lifecycle failures can outlive the request that caused them. The official advisory for CVE-2026-109618 demonstrates mod_php RCE; FPM susceptibility is source-based, without a complete demonstrated FPM exploit for that CVE. CVE-2026-109619 separately confirms an application-dependent FPM upload-progress path. Read each GHSA for its precise evidence instead of treating every SAPI as an identical proven exploit.
05Cloudflare: why response visibility matters
Cloudflare describes full-transaction detection using both request and origin response, allowing a matched response to be blocked before potential data leaves the proxy. This is useful for disclosure paths that do not launch a shell. The article’s rollout time is a historical snapshot, not a guarantee for your account: verify rule availability, routing, exclusions and event logs. Direct-origin paths and unproxied hosts still need patching and review.