A thirty-day assurance loop for PHP2Shell remediation

An emergency patch can be complete on the day it is deployed and still leave gaps in the running estate. PHP2Shell remediation needs a short assurance period because old workers, embedded runtimes, shared-hosting handlers and new deployments can keep a vulnerable path alive.

The two vulnerabilities are CVE-2026-109618 and CVE-2026-109619, both unauthenticated RCE flaws rated CVSS v4.0 9.2. PHP released fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026. PHP 8.2 is scheduled to reach end of life on December 31, 2026, so this incident also belongs in the longer upgrade plan.

CYFIRMA reports a captured 216-host target list and operator claims of 581 hosts. Those figures describe suspected targeting and self-reported expansion, not a confirmed victim population.…