PHP2Shell: a PHP patching checklist for your operations in Spain

1. Identify the runtime, not just the website platform

The flaws are CVE-2026-109618 and CVE-2026-109619, both rated critical at CVSS 9.2. They affect PHP memory handling and state across requests. Confirmed impact includes remote code execution and memory disclosure under vulnerable conditions.

PHP documents different exploit paths for mod_php and PHP-FPM. Deployment details matter, and some paths rely on subsequent requests reaching the same worker.

• Inventory WordPress, WooCommerce, PrestaShop, Joomla and Drupal hosting.
• Include PHP-based internal tools, booking systems and guest portals.
• Check appliance vendors before assuming a particular device is affected.
• Include Windows servers running PHP. Systems without vulnerable PHP are not directly affected by these flaws.

2. Check the fixed release or vendor backport

The supported branch releases below contain the fixes. Ask the vendor to identify a complete backport if the package version differs. Older branches remain outside regular support even when exceptional patches exist.

PHP 8.1 and older are outside regular upstream support. PHP provides exceptional source backports for 7.4, 8.0 and 8.1. Validate the vendor package and plan migration. PHP 8.2 security support ends December 31, 2026.

3. Confirm what iDeo has already applied

Based on iDeo’s operational update supplied October 22, interim measures are in place on its hosting servers from PHP 5.6 onward. The complete PHP update remains necessary.

• Upload progress has been disabled with session.upload_progress.enabled = 0, blocking a demonstrated attack path.
• Strict sessions are enabled with session.use_strict_mode = 1 as general hardening, not a full PHP2Shell fix.
• Updates for PHP 7.4 and later distributed through Plesk and cPanel are being applied progressively.
• Websites on PHP 7.3 or older need migration planning with the customer.

4. Obtain restart and status evidence

Ask for the exact version, package identifier and confirmation that PHP workers restarted after the update. WordPress and plugin updates alone do not solve this issue.

For managed systems, iDeo’s user support center checks PHP deployments, starts with Internet-facing services, reviews possible intrusion indicators and contacts external hosting vendors. We record corrected systems and pending work for your team. Any restart interruption is coordinated, not promised to last a fixed number of minutes.

5. Treat temporary controls as temporary

PHP explicitly warns that no generic configuration workaround is complete. Disabling upload progress addresses one path. Request limits or a WAF may reduce exposure but do not replace a complete patch.

Server administrators must enforce changes and restart workers. A setting inside a WordPress plugin is not sufficient. Agree on exposure restrictions if the system cannot be patched yet.

6. Preserve evidence and assess reporting duties

INCIBE reports attacks preceding patch release; CISA said it had not observed exploitation when publishing its October 21 alert. We do not infer a universal incident status from those statements.

If you see unexpected files, redirects or account activity, contact your technical team and preserve evidence. For personal data in the Spanish operation, assess GDPR notification with the privacy lead: a notifiable breach generally has a 72-hour deadline from awareness unless it is unlikely to risk individuals’ rights and freedoms. This is not a blanket rule for every incident.