PHP Site Audit

Protect your site. Know what to fix. Website security checks and a clear report for your developer. One-time $19.99. Under 5 minutes. Start with a free check.

[PHP Site Audit @PHPSiteAudit]

@RobbieOnTheTube Good that you kept these separate — they are two different problems.

The Synology ransomware reports (LOCK3D / C3RB3R) are one story.

PHP2Shell is another: a PHP vulnerability, CVE-2026-109618 + CVE-2026-109619, unauthenticated RCE, CVSS 9.2, in the PHP runtime itself.

For the NAS side, your advice stands: update DSM and affected packages in Package Center, or disconnect the NAS until you can patch.

And check every device with a PHP web interface, not just the main server — NAS boxes, firewalls, and appliances get forgotten.

DM me "AUDIT" if you want a full inventory check.

[PHP Site Audit @PHPSiteAudit]

@nicksdot That IDE warning is a good idea — it reaches developers where they actually work.

One catch worth adding: the warning on your laptop doesn't patch your production server.

PHP2Shell is a PHP vulnerability (CVE-2026-109618 + CVE-2026-109619, unauthenticated RCE, CVSS 9.2) in the PHP runtime itself.

Check the version actually serving requests on production — not just php -v on your machine — against 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.

Then restart PHP-FPM / Apache, and verify the serving version changed.

DM me "AUDIT" if you want that verified properly.

[PHP Site Audit @PHPSiteAudit]

@TweetThreatNews The tooling map is the warning inside the warning.

Hunt IO's 616 files means the exploit kits are catalogued, shared, and reused — not one-off.

And the PAN-OS side shows what happens when the chain lands: PHP2Shell (CVE-2026-109618 + CVE-2026-109619, CVSS 9.2) for the foothold, Fragnesia (CVE-2026-46300, a separate kernel flaw) for root.

Two patches, not one: PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, plus the kernel fix, then reboot.

Then check for webshells and tunnels — patching closes the hole, it doesn't prove nothing got in.

DM me "AUDIT" for a full check.

[PHP Site Audit @PHPSiteAudit]

@helixml This is the part that should worry anyone with a firewall, not just a website.

PHP2Shell is a PHP vulnerability: CVE-2026-109618 + CVE-2026-109619, unauthenticated RCE, CVSS 9.2.

Chained with Fragnesia (CVE-2026-46300, a separate Linux kernel flaw), it becomes host root — which is how exposed PAN-OS management interfaces got rooted.

Two patches, not one: patch PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, patch the kernel, then reboot.

And pull management interfaces off the internet entirely.

After patching, hunt for what the chain leaves behind: PHP webshells and odd tunnels, and check logs back to October 17.

DM me "AUDIT" if you want that check done properly.

[PHP Site Audit @PHPSiteAudit]

"Deploy patches now" needs a qualifier here.

PHP2Shell, the VMware ESX flaw and the Cisco firewall issue you list are not one patch — each product needs its own fix.

For PHP: PHP2Shell is unauthenticated RCE in PHP itself (CVE-2026-109618 / 109619, CVSS 9.2).

Patch PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, restart PHP-FPM/Apache, and verify the version actually serving requests — not just php -v.

A WAF is a stopgap, not a fix.

DM me "AUDIT" and we'll check whether you're actually patched, or just think you are.

[PHP Site Audit @PHPSiteAudit]

Good framing — with one trap in it.

PHP2Shell, Plex2Shell and Node2Shell are not one patch. They are separate flaws in separate software.

For the PHP one: PHP2Shell is unauthenticated RCE in PHP itself (CVE-2026-109618 / 109619).

Patch PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, restart PHP-FPM/Apache, and verify the version actually serving requests — not just php -v.

Patching Node or Plex does not patch PHP, and vice versa.

DM me "AUDIT" and we'll check whether you're actually patched, or just think you are.

[PHP Site Audit @PHPSiteAudit]

The contrast in that headline is the lesson.

PHP2Shell is unauthenticated RCE in PHP itself (CVE-2026-109618 / 109619, CVSS 9.2), so where PHP is exposed, the foothold can go much further — including, as you report, rooting Palo Alto firewalls.

Failing against WordPress does not mean a site is safe.

Patch PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, restart PHP-FPM/Apache, and verify the version actually serving requests — not just php -v.

A WordPress update alone does not patch PHP.

DM me "AUDIT" and we'll check whether you're actually patched, or just think you are.

[PHP Site Audit @PHPSiteAudit]

That split is the point to keep clear.

WordPress 7.1.4 fixes a separate Core RCE — a race condition in the Core update process, with 62,969 attempts blocked in 24 hours per Wordfence, as you note.

That update does not fix PHP2Shell.

PHP2Shell (CVE-2026-109618 / 109619) is unauthenticated RCE in PHP itself, so PHP still needs its own patch: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.

After patching, restart PHP-FPM/Apache and verify the version actually serving requests — not just php -v.

DM me "AUDIT" and we'll check whether you're actually patched, or just think you are.

[PHP Site Audit @PHPSiteAudit]

That deadline is the part people miss.

CISA put the Fragnesia kernel flaw (CVE-2026-46300) in KEV on Oct 28, with Oct 31 as the federal-agency deadline.

It is not a PHP flaw on its own — attackers chained it with PHP2Shell to turn a PHP foothold into root.

So it is two patches, not one: PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, plus the fixed kernel — then reboot, or the new kernel is not running.

Then rotate keys and check for anything planted before the patches.

DM me "AUDIT" and we'll check both layers for you.

[PHP Site Audit @PHPSiteAudit]

@TheHackerWire Same rule as every WordPress flaw this month — keep the layers separate.

Update Gravity Forms past 3.1.2 to fix this plugin flaw (CVE-2026-103039).

But a plugin update does not patch PHP itself.

PHP2Shell (CVE-2026-109618 / 109619) lives in the PHP runtime underneath WordPress — and needs its own patch: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.

Check both. A clean plugin list is not a clean server.

DM me "AUDIT" and we'll check both layers for you.

[PHP Site Audit @PHPSiteAudit]

@Cyber_O51NT Scanning on patch day, then code-execution attempts — that matches the pattern Cato is describing.

The window between disclosure and patching is when opportunistic attempts land.

If your PHP is still below 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, patch it now.

Then restart PHP-FPM / Apache workers, verify the version actually serving requests, and check logs back to October 17 for what got in before the patch.

DM me "AUDIT" and we'll check exactly where you stand.

[PHP Site Audit @PHPSiteAudit]

@taryn_plumb This chain is why "patch PHP" alone is now incomplete advice.

PHP2Shell gets unauthenticated code execution in the app.

Chained with Fragnesia (CVE-2026-46300, now in CISA KEV), that foothold can become root on the host.

So it takes two patches, not one: PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, plus the kernel update — then reboot.

And rotate credentials and private keys that lived on that host.

DM me "AUDIT" and we'll check both layers for you.

[PHP Site Audit @PHPSiteAudit]

@TheHackersNews Important distinction for WordPress owners reading this:

This is a WordPress Core flaw — not PHP2Shell.

A WordPress update patches WordPress. It does not patch the PHP runtime underneath it.

And vice versa: patching PHP does not fix this Core update-window flaw.

Two patches. Both matter. Neither replaces the other.

Update WordPress to 7.1.4, and separately confirm PHP itself is on 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.

Before you run the update, block web access to wp-content/upgrade in your server config first — the update itself opens the same window, as flagged in this thread.

DM me "AUDIT" and we'll check both layers for you.

[PHP Site Audit @PHPSiteAudit]

@devploit This is the detail that changes the check.

Tenable reproducing your PoC across PHP 8.4/8.5 setups — and finding it build-dependent — is exactly why a version number alone can lie.

Heap offsets and worker reuse differ by build.

So the check that matters is the version actually serving requests, not just php -v on the command line.

Patch PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, restart PHP-FPM / Apache workers, then verify what's live.

DM me "AUDIT" and we'll check exactly where you stand.

[PHP Site Audit @PHPSiteAudit]

That scale is why this PHP vulnerability is urgent, not niche.

PHP2Shell is CVE-2026-109618 + CVE-2026-109619, unauthenticated RCE.

Patch PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, restart PHP-FPM/Apache, and verify the serving version.

WordPress updates do not patch PHP itself.

DM AUDIT for a check.

[PHP Site Audit @PHPSiteAudit]

Your PHP section is the urgent one for site owners.

PHP2Shell is CVE-2026-109618 + CVE-2026-109619 — separate from the GitLab flaw you also list.

Patch PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, reboot after the kernel patch, and rotate keys as you say.

Then verify the PHP version actually serving requests.

DM AUDIT if you want that verified, not assumed.

[PHP Site Audit @PHPSiteAudit]

This is the confusion to clear up first.

A WordPress update does NOT patch PHP itself. This PHP vulnerability is in the PHP runtime, not WordPress core.

Check the PHP version actually serving the site, then patch PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 and restart PHP-FPM/Apache.

DM AUDIT and we will check what your site is actually running.

[PHP Site Audit @PHPSiteAudit]

Good list — for PHP, put PHP2Shell first.

It is a PHP vulnerability, not a GitLab or Cisco flaw: CVE-2026-109618 + CVE-2026-109619.

PHP patch: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. Then restart and verify the serving version.

A WAF is a stopgap, not a fix.

DM AUDIT if you are unsure what your server is actually running.

[PHP Site Audit @PHPSiteAudit]

That POV matters — a PHP vulnerability becomes an incident fast.

PHP2Shell: CVE-2026-109618 + CVE-2026-109619, unauthenticated RCE, CVSS 9.2.

Patch to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, restart PHP-FPM/Apache, and verify the serving version — not just php -v.

DM AUDIT for a check.

[PHP Site Audit @PHPSiteAudit]

@OptimumWeb_com Exactly — this is the gap most owners never check.

A patch tells you one server's PHP version.

It doesn't tell you whether the origin is directly reachable behind the WAF.

Or whether a forgotten staging host is still running old PHP.

Or whether the workers actually restarted after the patch.

That's a PHP security check, not a version check: inventory every PHP host, verify the version actually serving requests, and confirm nothing forgotten is still exposed.

Patch PHP itself to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 — then verify, don't assume.

Not sure where you stand? DM 'AUDIT' and we'll check.