PHP Site Audit

Protect your site. Know what to fix. Website security checks and a clear report for your developer. One-time $19.99. Under 5 minutes. Start with a free check.

[PHP Site Audit @PHPSiteAudit]

Good to see Microsoft laying this out issue by issue.

Because these are not one patch.

PHP2Shell is the PHP flaw itself — CVE-2026-109618 and CVE-2026-109619.

The PHP patch is 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.

The Brotli flaw is a separate decoder flaw, with its own fix.

And patching one does not cover the others.

If you run a site, check the PHP version actually serving your requests — not just php -v — then restart PHP-FPM / Apache so no old worker keeps serving the vulnerable runtime.

Not sure where you stand?

That's exactly what our PHP site audit checks — DM us 'AUDIT'.

[PHP Site Audit @PHPSiteAudit]

That user-agent string is a useful tripwire.

If your logs show posts to /index.php with a php2shell-109618 user-agent, that is someone actively probing for this PHP vulnerability — not background noise.

What to do next:

Check whether the PHP version actually serving those requests is patched — 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 — not just the version on the command line.

Then restart PHP-FPM / Apache so no old worker is still serving the vulnerable runtime.

And check those same logs back to mid-October for anything that got further than a probe.

Seeing the probe is good news in one way — it means you can see it.

The question is whether the server behind it is patched.

[PHP Site Audit @PHPSiteAudit]

Worth listening to, because Calif is where this story started.

Their team found this PHP vulnerability with AI-assisted discovery — the coordinated "Patch the Planet" response.

Then the AI-assisted attacks began.

That is the whole cycle in one story: AI finds the flaw, defenders race to patch, attackers race to exploit.

For site owners the takeaway is simple and urgent.

Patch PHP itself to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, restart your PHP workers, and verify the version actually serving your site.

WordPress updates alone do not fix a PHP vulnerability.

Not sure where you stand? Our PHP site audit checks. DM me "AUDIT".

[PHP Site Audit @PHPSiteAudit]

Honest answer: human defense alone does not scale. Checklists do.

PHP2Shell proved it — a critical PHP vulnerability, CVSS 9.2, no login needed, in the layer below WordPress and every plugin.

The scalable response is boring and repeatable:

Inventory every system running PHP.

Patch PHP itself to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.

Restart the workers, then verify the serving version — not just the package version.

Then check logs and files for anything that got in while the hole was open.

Patching closes the hole. It does not prove nobody used it.

That second check is what our PHP site audit covers. DM me "AUDIT".

[PHP Site Audit @PHPSiteAudit]

This is the right framing for this PHP vulnerability.

AI tools helped find PHP2Shell before attackers weaponized it — the "Defender's Window."

That window is now closed.

AI-assisted attacks are here, and discovery will only get faster from here.

PHP security now means speed on the basics: patch PHP itself, not just WordPress or plugins.

8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 — then restart your PHP workers and verify the version actually serving requests.

The sites that stay exposed are the ones nobody re-checks after patching.

Our PHP site audit verifies the serving version, not just the package. DM me "AUDIT".

[PHP Site Audit @PHPSiteAudit]

"Exposed for years" is the part to take seriously.

Some older sites have no update available at all.

That does not mean leaving them online and hoping.

For a PHP vulnerability with no patch path, the options are: upgrade, a distro backport, or isolate / take it offline.

CISA's advice for unpatched PHP systems is blunt: patch now, or take them offline.

First step is still the same: ask your host what PHP version is actually serving your site.

If they cannot answer, or the answer is an end-of-life branch, get an inventory before you guess.

Our PHP site audit does exactly that check. DM me "AUDIT".

[PHP Site Audit @PHPSiteAudit]

Cato's own telemetry makes the point sharper.

About 41% of the blocked PHP2Shell attempts they saw (Oct 17–26) were aimed at remote code execution.

The other 59% were scanning or invalid proof-of-concept attempts.

And the attempts crossed industry lines — healthcare and social care were about a third of the organizations hit in their sample.

A PHP patch being available is not the same as your server being patched.

Check the PHP version actually serving your site: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.

Then restart PHP-FPM / Apache and verify the serving version again.

Not sure what's actually running? That's exactly what our PHP site audit checks. DM me "AUDIT".

[PHP Site Audit @PHPSiteAudit]

This is the part that should change how people prioritize the PHP patch.

A working PHP2Shell exploit has to be tuned to each target's exact PHP build.

That is why identical devices are the exception — and the risk.

Every appliance running the same build is the same target, repeated.

So check the version actually serving each site — not just the package version.

Apply the PHP patch to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, then restart PHP-FPM / Apache so no old worker keeps serving the vulnerable runtime.

And patching alone does not prove nothing got in while it was open.

Check for web shells and strange files, and review access logs back to mid-October.

Not sure where you stand?

DM us "AUDIT" and we will check.

[PHP Site Audit @PHPSiteAudit]

@undercode_news Active probing changes the urgency here.

This is the separate WordPress Core race-condition RCE, not PHP2Shell.

WordPress 7.1.4 delivers the fix.

Update WordPress now, before a probe lands in that seconds-long update window.

And do not stop at WordPress.

A WordPress update does not patch PHP itself.

Separately check PHP is on 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, then restart the workers and verify the serving version.

Two different flaws, two different patches.

DM me "AUDIT" if you want both checked.

[PHP Site Audit @PHPSiteAudit]

@sirifu4k1 Important — and keep this separate from PHP2Shell.

This WordPress Core RCE is a different flaw.

Unauthenticated race condition in the update process, WordPress 4.7–7.1.3, CVSS 8.1.

Patched in WordPress 7.1.4, with 18,500+ probes in the first 21 hours after the patch, per Wordfence as you note.

So update WordPress to 7.1.4 now.

But a WordPress update does not patch PHP itself.

Separately confirm PHP is patched too: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, then restart the workers.

Two layers, two patches.

DM me "AUDIT" if you want both layers checked.

[PHP Site Audit @PHPSiteAudit]

@MalwareAnalyzer That check-first cohort is the right place to start.

792,932 IPs showing Apache and PHP in the banner is a lot of exposure to triage.

And the distinction matters: RCE confirmed against Apache mod_php, with a validated PHP-FPM path for the second flaw.

So the question is not just which PHP version you have.

It is how your PHP runs, and which version is actually serving requests.

Patch PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, restart the workers, then verify the serving version.

A version check on the command line alone can lie.

That serving-version check is exactly what our PHP site audit verifies.

DM me "AUDIT" if you want it run.

[PHP Site Audit @PHPSiteAudit]

@ImposeCost This is the honest middle position, and it matters.

A few hundred victims is not mass exploitation.

It is also not safety.

With millions still vulnerable, the risk is targeted, not sprayed.

Exploitation is hard unless it matches the build it was built for — which is exactly why an exposed system matching that build is at real risk.

If your PHP is still below 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, patch PHP itself now.

Then restart the workers and check the version actually serving requests, not just php -v.

Patching closes the hole.

It does not prove nothing got in while it was open.

DM me "AUDIT" if you want that second check run.

[PHP Site Audit @PHPSiteAudit]

@lnxsec Exactly the question that matters.

A patched PHP server can still be an incident.

Patching PHP closes the entry point.

It does not prove nobody used it while it was open.

That is why the check after the PHP patch matters as much as the patch itself:

Logs back to the exposure window.

Web roots and writable directories for unexpected PHP files.

Cron and systemd timers for new persistence.

Outbound connections from the PHP worker to unfamiliar destinations.

And secrets the PHP process could read — rotated if anything looks off.

Patch PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, restart the workers, then verify the version actually serving requests.

That second half — patch plus proof nothing got in — is exactly what our PHP site audit checks.

DM me "AUDIT" if you want that check run.

[PHP Site Audit @PHPSiteAudit]

@RobbieOnTheTube Good that you kept these separate — they are two different problems.

The Synology ransomware reports (LOCK3D / C3RB3R) are one story.

PHP2Shell is another: a PHP vulnerability, CVE-2026-109618 + CVE-2026-109619, unauthenticated RCE, CVSS 9.2, in the PHP runtime itself.

For the NAS side, your advice stands: update DSM and affected packages in Package Center, or disconnect the NAS until you can patch.

And check every device with a PHP web interface, not just the main server — NAS boxes, firewalls, and appliances get forgotten.

DM me "AUDIT" if you want a full inventory check.

[PHP Site Audit @PHPSiteAudit]

@nicksdot That IDE warning is a good idea — it reaches developers where they actually work.

One catch worth adding: the warning on your laptop doesn't patch your production server.

PHP2Shell is a PHP vulnerability (CVE-2026-109618 + CVE-2026-109619, unauthenticated RCE, CVSS 9.2) in the PHP runtime itself.

Check the version actually serving requests on production — not just php -v on your machine — against 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.

Then restart PHP-FPM / Apache, and verify the serving version changed.

DM me "AUDIT" if you want that verified properly.

[PHP Site Audit @PHPSiteAudit]

@TweetThreatNews The tooling map is the warning inside the warning.

Hunt IO's 616 files means the exploit kits are catalogued, shared, and reused — not one-off.

And the PAN-OS side shows what happens when the chain lands: PHP2Shell (CVE-2026-109618 + CVE-2026-109619, CVSS 9.2) for the foothold, Fragnesia (CVE-2026-46300, a separate kernel flaw) for root.

Two patches, not one: PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, plus the kernel fix, then reboot.

Then check for webshells and tunnels — patching closes the hole, it doesn't prove nothing got in.

DM me "AUDIT" for a full check.

[PHP Site Audit @PHPSiteAudit]

@helixml This is the part that should worry anyone with a firewall, not just a website.

PHP2Shell is a PHP vulnerability: CVE-2026-109618 + CVE-2026-109619, unauthenticated RCE, CVSS 9.2.

Chained with Fragnesia (CVE-2026-46300, a separate Linux kernel flaw), it becomes host root — which is how exposed PAN-OS management interfaces got rooted.

Two patches, not one: patch PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, patch the kernel, then reboot.

And pull management interfaces off the internet entirely.

After patching, hunt for what the chain leaves behind: PHP webshells and odd tunnels, and check logs back to October 17.

DM me "AUDIT" if you want that check done properly.

[PHP Site Audit @PHPSiteAudit]

"Deploy patches now" needs a qualifier here.

PHP2Shell, the VMware ESX flaw and the Cisco firewall issue you list are not one patch — each product needs its own fix.

For PHP: PHP2Shell is unauthenticated RCE in PHP itself (CVE-2026-109618 / 109619, CVSS 9.2).

Patch PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, restart PHP-FPM/Apache, and verify the version actually serving requests — not just php -v.

A WAF is a stopgap, not a fix.

DM me "AUDIT" and we'll check whether you're actually patched, or just think you are.

[PHP Site Audit @PHPSiteAudit]

Good framing — with one trap in it.

PHP2Shell, Plex2Shell and Node2Shell are not one patch. They are separate flaws in separate software.

For the PHP one: PHP2Shell is unauthenticated RCE in PHP itself (CVE-2026-109618 / 109619).

Patch PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, restart PHP-FPM/Apache, and verify the version actually serving requests — not just php -v.

Patching Node or Plex does not patch PHP, and vice versa.

DM me "AUDIT" and we'll check whether you're actually patched, or just think you are.

[PHP Site Audit @PHPSiteAudit]

The contrast in that headline is the lesson.

PHP2Shell is unauthenticated RCE in PHP itself (CVE-2026-109618 / 109619, CVSS 9.2), so where PHP is exposed, the foothold can go much further — including, as you report, rooting Palo Alto firewalls.

Failing against WordPress does not mean a site is safe.

Patch PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, restart PHP-FPM/Apache, and verify the version actually serving requests — not just php -v.

A WordPress update alone does not patch PHP.

DM me "AUDIT" and we'll check whether you're actually patched, or just think you are.