Apply the fixed release
If you run PHP 8.2 through 8.5, move to 8.2.35, 8.3.36, 8.4.27 or 8.5.12. That closes PHP2Shell on supported branches.
PHP2Shell: CVE-2026-109618 and CVE-2026-109619
PHP2Shell is patched. Is your PHP still supported?
On Oct 21, 2026 the PHP project shipped fixes for two critical unauthenticated remote code execution flaws. Patching is the first step. The bigger question is whether your applications run on a PHP version that will keep getting fixes like this one.
The facts
What shipped and which versions are fixed
- CVEs
- CVE-2026-109618 and CVE-2026-109619
- Severity
- Critical, CVSS v4.0 9.2 each, unauthenticated remote code execution
- Affected
- Every PHP version up to 8.5.11
- Fixed releases
- 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (released Oct 21, 2026)
- PHP 8.1 and older
- No official fix from the PHP project. Only third-party backports.
- PHP 8.2
- Security support ends Dec 31, 2026
Reports about exploitation in the wild are mixed. Check the official PHP release notes and your vendors' advisories for the latest guidance.
What to do
Patch today. Upgrade before Dec 31.
There is no official patch
PHP 7.x and 8.1 get no fix from the PHP project. Backports can buy time, but each new flaw means another one, and the code underneath keeps aging.
Plan off PHP 8.2
8.2 got this fix, but its security support ends Dec 31, 2026. After that, the next critical flaw will not be patched there either. Moving to 8.3 or 8.4 keeps you on supported releases.
How Sur helps
We upgrade legacy PHP without pulling your engineers off the roadmap
Sur Consulting is an upgrade and migration firm. We move PHP 7.x and 8.x applications to current PHP 8.3 or 8.4 using AI agent workflows, and our engineers review every plan and every release.
- 1
Inventory. We find every PHP application and the version, framework and extensions it depends on.
- 2
Exposure. We show which apps sit on versions with no official fix, and which lose support on Dec 31, 2026.
- 3
Upgrade path. We write a step-by-step plan to 8.3 or 8.4, with a fixed scope you approve before any code changes.
- 4
Migrate. AI agents do the upgrade work in your environment, your tests confirm it, and our engineers review it before it ships.
Proof point: we moved a client off TIBCO to Spring Boot two weeks after onboarding and avoided about $3M in licensing.
Sur is not a security firm and does not investigate or detect compromise. If you suspect a breach, contact your incident response provider.
The entry offer
The Code Assessment: $15K
A fixed-price assessment that turns "we should upgrade PHP" into a plan your team can approve.
- ✓Inventory of your PHP applications, versions and dependencies
- ✓Exposure map: which apps have no official fix and which lose support Dec 31
- ✓A written upgrade path to PHP 8.3 or 8.4 with a fixed migration scope
- ✓Your engineers stay on the roadmap while we do the work
$15K
Fixed price. Written plan you own.
Book a 15-minute callNot ready? Start with the free snapshot below.
Free
Get your PHP Exposure Snapshot
Tell us what you run. We will reply with a short snapshot: which of your PHP versions have a fixed release, which have no official fix, and which lose support on Dec 31, 2026, plus the simplest upgrade target for each.
We use your details only to send the snapshot and follow up about it. We never sell or share them. Reply "unsubscribe" to any email to stop hearing from us.
Request your snapshot
Book 15 minutes with Mohammed, our founder and an engineer. Bring your PHP versions and number of apps, and we will send the snapshot after the call.
Book a 15-minute callPrefer email? Write to mawad@surconsultinggroup.com
FAQ
Common questions
We already patched. Are we done?
If you are on 8.3, 8.4 or 8.5 and applied the fixed release, you are on a supported branch. If you are on 8.2, you are patched for now, but support ends Dec 31, 2026. If you are on 8.1 or older, there is no official fix.
We run PHP 7.x. What are our options?
Third-party backports can reduce risk short term. The lasting fix is moving to PHP 8.3 or 8.4. That is the work we do.
Can you tell us whether we were attacked?
No. Sur is an upgrade and migration firm, not a security firm, and we do not detect or investigate compromise. Talk to your incident response provider for that.
Will this pull our engineers off the roadmap?
No. AI agent workflows do the upgrade work and our engineers review it. Your team approves the plan and the release.
What does the Code Assessment cost?
$15K, fixed price. You get an inventory, an exposure map and a written upgrade path with a fixed migration scope.
Is the snapshot really free?
Yes. No commitment. It is a short written summary based on what you tell us.
Patch today. Upgrade before Dec 31.
A short call is enough to see where your PHP stands.
Book a 15-minute call