PHP2Shell patched in 20 minutes
Intercube patched every server within 20 minutes of the PHP2Shell security patch becoming available on 21 October 2026. There was no application downtime throughout our response, including the period before the patch arrived. Customers kept using their applications while our engineers handled the early precautions and the final security update.
- Author
- Intercube
- Published
- Reading time
- 3 min read
01
A critical update to the PHP runtime
The PHP security team released fixes for CVE-2026-109618 and CVE-2026-109619 on 21 October. The vulnerabilities, discussed as PHP2Shell, can allow unauthenticated remote code execution in PHP installations serving web requests. The official advisory calls for an immediate update.
For a business running Magento, WordPress or a custom PHP application, this reaches below the application itself. Updating a module or plugin leaves the server’s PHP runtime unchanged. Someone needs to own that update too.
02
Every server patched within 20 minutes
Our response started before the security patch was available. Intercube engineers applied a temporary configuration precaution to PHP’s session upload-progress processing and checked it in running services. Ordinary file uploads were tested before and after the change and continued to work. Customers’ applications stayed online while we prepared for the release.
Once the patch became available on 21 October 2026, we patched every server within 20 minutes. Applications remained available throughout the response, from the earlier precautions through the completed patch rollout. We did not take customer applications offline to wait for the release.
Our earlier PHP2Shell article explains the background and the precaution taken before the release. The official security patch has now corrected the underlying vulnerabilities in our PHP runtimes.
03
Put urgent maintenance with your hosting team
You should not have to interrupt your development work to deal with an urgent PHP security release. With Intercube, our engineers take responsibility for runtime updates, so your team can stay focused on the application.
If your current hosting leaves PHP updates with your development team, we can take that responsibility into a managed hosting relationship. We assess the application and its dependencies, prepare the target environment and plan the transfer with you. Migration to Intercube managed hosting is included at no additional cost.
The completed response
- PHP2Shell security patches released on 21 October 2026.
- Every Intercube server patched within 20 minutes of availability.
- Applications stayed online from the early precautions through the completed patch rollout.
- Temporary configuration work followed by the PHP security correction.
- Runtime maintenance carried out by the managed hosting team.
- Migration to Intercube managed hosting included at no additional cost.