PHP2Shell — two critical flaws in PHP, the language behind roughly three-quarters of the web, tracked as CVE-2026-109618 and CVE-2026-109619 — sent companies and governments scrambling on Wednesday, October 21. Some took their websites offline rather than wait. We patched every PHP service we run the same afternoon, about three hours after the fix was released, with Claude Code doing the work. One machine is still waiting, and we’ll tell you which.
What happened
- The flaws: unauthenticated remote code execution in PHP itself, rated 9.2 (CVSS v4.0). Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Found by AI: Wiz says AI found them, working with the security firm Calif, in code that had gone unnoticed for more than a decade. Wiz’s own words: “With AI this is no longer a barrier.”
- The reach: “All servers using any version of PHP released in the last 20 years will be vulnerable,” said Tiffany Farriss, interim CEO of the Drupal Association. WordPress, Drupal, Joomla and Magento all run on PHP.
- The fallout: the Dutch National Cyber Security Centre, the Port of Rotterdam and Overheid.nl went offline. So did Finland’s government network provider Valtori, Denmark’s national school platform and some of Wikipedia’s systems. France put every Interior Ministry website into maintenance.
- The race: security firms warned that attacks had already begun. Costin Raiu of TLP:Black warned of a possible “mass compromise of every vulnerable web server on the internet.”
What we did, and how fast
LIBCSystems runs a full business suite and dozens of sites on infrastructure we operate ourselves: mail, cloud files, webmail, blogs, admin panels. Fourteen of those services run PHP. One architect is in charge, and Claude Code is the team.
- All 14 PHP services patched the same day. The fixed builds were committed at 16:34 UTC on October 21, about three hours after the PHP project released the fix.
- We didn’t wait for anyone else’s packages. The official patched container images weren’t published yet, so Claude built them from Docker’s own official recipes, checking every PHP download against php.net’s published checksums.
- Only PHP changed. Every application — Nextcloud, Roundcube, phpMyAdmin, WordPress — stayed pinned to the exact version it was already running, with the same extensions, checked old against new. Patching a flaw is no time to start an upgrade.
- Verified, not assumed. Our automated estate check passed 91 of 91 sites and services afterwards. Every cloud reported healthy, and every login page was confirmed to render.
- A way back for everything. The old images were kept, every changed file was backed up, and the whole change was committed.
Then we checked whether anyone got in
A patch closes the door. It doesn’t tell you whether someone walked through before you closed it. So the same day, Claude ran a compromise hunt:
- About 2.7 million web requests reviewed going back to October 6.
- Files and processes checked: no crashed PHP workers, no planted files, no rogue processes, no new scheduled jobs or keys. WordPress and Nextcloud checksums all matched.
- Every account on every system audited. Every new account in the last two weeks traced back to our own work.
- The closest call: scanners sent oversized requests that fit the shape of this attack to eleven of our sites. Every one was turned away by our web server’s size limit before PHP ever saw it.
Verdict: no evidence of compromise. The audit also turned up older housekeeping — over-broad permissions, a stale admin account or two — and those were fixed the same day.
The one thing that isn’t patched yet: Homebrew
Everything internet-facing was patched on Wednesday. The exception is the architect’s own Mac, which gets PHP from Homebrew, the Mac package manager. On Wednesday, Homebrew still shipped 8.5.11. Claude wrote a mitigation config for it and flagged it, and that’s all you can do when the package doesn’t exist yet. The Mac’s web server only listens to itself, so nothing on the internet could reach it.
Homebrew published 8.5.12 on Thursday morning, so that upgrade is next. We’re telling you because honest reporting is the job. “Everything is patched” should mean everything.
If you run PHP, do this today
- Find every PHP you have — web servers, containers, old command-line copies on admin machines. The ones you forgot about are the ones that bite.
- Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. WordPress auto-updates won’t do it for you: this is PHP itself, not a plugin.
- Don’t stop at the patch. Check your logs, your files and your user accounts for anything that happened before you patched.
- Can’t patch yet? Take it offline. That’s what governments did on Wednesday, and it was the right call.
This is what we mean when we say AI is my team. The patch, the rebuild, the verification and the hunt took a day, not a week. A person decided what got touched, and signed off on the result. If you’d like the same for your business, talk to us.
Sources: RTÉ News / Reuters, October 21–22, 2026 · CNBC, October 21, 2026 · CNBC, October 22, 2026 · php.net
Image: PHP logo by Colin Viebrock, php.net, licensed CC BY-SA 4.0. Banner by LIBCSystems, also CC BY-SA 4.0. No endorsement by the PHP project is implied.