A deployed system remains a responsibility
A system can be working, serving customers and generating revenue while a component of its infrastructure needs an urgent fix. The absence of a visible error does not prove that the environment is protected.
That is why I insist on looking at software beyond development. Deployment starts an operation that must remain reliable. Someone needs to track its components, assess alerts and apply changes quickly. When that responsibility is unclear, the company turns maintenance into improvisation.
What happened with PHP
On October 21, 2026, fixes were published for two critical PHP vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and collectively known as PHP2Shell. Both received an official CVSS v4.0 score of 9.2. (PHP — release announcement, PHP — advance notice)
One involves state corruption during out-of-memory failures. The other involves internal references to freed memory that a subsequent request may use. The advisories describe conditions that can allow unauthenticated remote code execution. That is a serious potential impact; it does not mean every PHP application is being exploited in the same way. (Memory advisory, internal state advisory)
The issue reaches the application's infrastructure
The official guidance covers PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The project considers mod_php the highest risk, with a demonstrated attack path before application code executes. Configuration and execution paths matter. (PHP — advisory scope)
For a business, the practical question is where this runtime is present. It may support a company website, an online store, an internal portal or a third-party service. Identifying it requires knowing the environment that sustains operations.
A technical consequence becomes a business consequence
Unauthorized execution on a server can affect data, availability and trust. Its reach depends on the process's permissions and available connections. A component with access to other information can extend the impact of a failure that initially appears local.
That changes how maintenance should be assessed. The cost of updating needs to be considered alongside the cost of interrupted sales, losing access to a process or investigating possible exposure. Even when none of these happens, a company without an inventory and assigned owners wastes time discovering who should act.
Team size does not resolve that absence of a decision. A small operation needs to understand its limits and have clear owners for development, hosting and maintenance.
Updating requires a decision and verifiable delivery
Upstream fixes were released in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The PHP Foundation reinforced the need to update. For packages maintained by distributions or vendors, check the relevant advisory and whether a backported fix is available. (PHP Foundation — fixes and context)
Leadership needs to establish a priority, an owner and completion criteria. Reporting that an update has been requested does not prove that production is already using the fixed component.
The fix must also reach images, replicas and products that embed PHP. The Dutch NCSC advises checking these environments separately. The team should then confirm the effective version and validate important business workflows. (NCSC-NL — operational guidance)
An important update on October 23
On October 23, 2026, PHP recommended disabling session.upload_progress.enabled until the next bugfix release for an unusual session scenario. Include this additional guidance when updating. (PHP — October 23 advisory)
Following the advisory after applying the first patch is part of maintenance. Security depends on current information and someone able to turn it into action.
The video and responsibility after delivery
The video on PHP's critical vulnerabilities discusses exactly what this kind of alert means for those keeping applications online. Putting a system into production includes taking responsibility for its continued maintenance. (Watch the video on Instagram)