---
title: Another PHPocalypse
description: ""
lang: en
date: 2026-10-21T19:24:47.163Z
tags:
  - "Language: PHP"
  - Vulnerabilities
  - Security
---

Well, it's not looking dead to me

October 21, 2026

[PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet](https://www.wiz.io/blog/php2shell-php-rce).

In short, if you didn't update your PHP on the 21st, you're in danger.

You can check if you're vulnerable via a [self-hosted script](https://github.com/CyberRoute/php2shell-scanner) or the [Brandefense ATLAS checker](https://atlas.brandefense.io/php-vulnerability-check).

Other light reading in attached links.

## Personal Experience

I had only one vulnerable service: Matomo Analytics (and Matomo's reaction to
most of their users getting screwed is quite underwhelming). Custom image on a
custom PHP distribution.

And even though it's a sad day for the internet, I am quite amused by my OCD
paying off:

- Matomo was inside a rootless container
- On a rootless container runtime
- With an isolated network
- Container had `cap_drop` and `no-new-privileges`
- Separate database and cache
- All consumers of the analytics script had it locally pinned or used [Subresource Integrity](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity)
- CI blocked any attempts by nightly builds to publish an image with an old PHP interpreter

There are some things that definitely need improvement, but overall, it's nice
not to be in a panic.

## Shameless Plug

Ironically, my second specialization after CI/CD/Platform Engineering is the
modernization of PHP applications (I've spent 20 years in PHP-related
development).

If you need something pulled out of the 7.x bog, help with fixing modern
deployments, or assistance in preventing/minimizing damage in the future, [send
me an email](mailto:damian.buho@proton.me).

I would also point out that this won't be the last drama of its kind, so embrace
it.

Brave new world: people without skills or responsibility wielding one of the
most powerful tools in human history.

## Tags

[Language: PHP](/tag/php/), [Vulnerabilities](/tag/vulnerabilities/),
[Security](/tag/security/)

## Navigation

[← Released Ignorelint](/post/released-ignorelint/) | [How to sing to caged
birds →](/post/how-to-sing-to-caged-birds/)

## Links

- [Article by JFrog](https://research.jfrog.com/post/php2shell-all-you-need-to-know-about-cve-2026-109618-and-cve-2026-109619/)
- [Article by SOCRadar](https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/)
- [Scan your site](https://atlas.brandefense.io/php-vulnerability-check)

## Skills

[PHP](/skill/php/), [Application Security](/skill/application-security/), CI/CD:
Jenkins, GitHub, Tekton