PHP2Shell: patching is phase 1. Phase 2 and 3 are coming
This kind of breach keeps me awake at night.
Patch now. And if you can’t patch, mitigate. Do not forget either one.
Yesterday the details of two PHP bugs leaked, CVE-2026-109618 and CVE-2026-109619, together known as PHP2Shell. Today the PHP team shipped the fixes. In between, the first attacks were already hitting honeypots. By the time you read this, scanners are trying every PHP server they can find.
Most of the coverage is about phase 1: the bug and the patch. I want to talk about what comes after.