Post: Another PHPocalypse: CVE-2026-109618 and CVE-2026-109619

damian.buho@proton.me (Damián Búho) — Wed, 21 Oct 2026 19:24:47 GMT

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet.

In short, if you didn't update your PHP on the 21st, you're in danger.

You can check if you're vulnerable via a self-hosted script or the Brandefense ATLAS checker.

Personal Experience

I had only one vulnerable service: Matomo Analytics (and Matomo's reaction to most of their users getting screwed is quite underwhelming). Custom image on a custom PHP distribution.

And even though it's a sad day for the internet, I am quite amused by my OCD paying off:

Matomo was inside a rootless container
On a rootless container runtime
With an isolated network
Container had cap_drop and no-new-privileges
Separate database and cache
All consumers of the analytics script had it locally pinned or used Subresource Integrity
CI blocked any attempts by nightly builds to publish an image with an old PHP interpreter

There are some things that definitely need improvement, but overall, it's nice not to be in a panic.

Shameless Plug

Ironically, my second specialization after CI/CD/Platform Engineering is the modernization of PHP applications (I've spent 20 years in PHP-related development).

If you need something pulled out of the 7.x bog, help with fixing modern deployments, or assistance in preventing/minimizing damage in the future, send me an email.

I would also point out that this won't be the last drama of its kind, so embrace it.

Brave new world: people without skills or responsibility wielding one of the most powerful tools in human history.

#Language: PHP — Seconds to Midnight

Post: Another PHPocalypse: CVE-2026-109618 and CVE-2026-109619

Personal Experience

Shameless Plug