Critical PHP vulnerabilities: emergency response and coordinated remediation

On 21 October 2026, the PHP project released security updates addressing two critical vulnerabilities, collectively referred to as PHP2Shell.

• CVE-2026-109618: A memory corruption vulnerability associated with PHP's handling of out-of-memory conditions, potentially enabling remote code execution.
• CVE-2026-109619: A vulnerability involving improperly retained global state and memory references between requests, potentially enabling remote code execution.

Both vulnerabilities received a CVSS v4.0 score of 9.2 and affected multiple supported PHP branches.

The security implications extended across the global PHP ecosystem, including common hosting configurations, content management systems and PHP-dependent web applications.

The widespread nature of the vulnerabilities required hosting providers and operators of managed infrastructure to evaluate and update affected installations without unnecessary delay.

WAYSCloud's incident response was initiated on 23 October, following receipt of the notification that triggered its internal escalation procedures.

Immediately following the notification at approximately 14:00 CEST on Friday, WAYSCloud activated its internal incident response organisation.

The initial response included an assessment of affected infrastructure, customer environments, service dependencies and the potential consequences of temporarily suspending affected services.

Two principal response strategies were considered:

• Temporarily suspending affected services until the relevant security updates had been deployed and verified.
• Maintaining customer-facing services during immediate, coordinated patch deployment, followed by application-specific remediation and verification.

The assessment considered both the security implications of continued operation during remediation and the operational consequences of a widespread service suspension.

Particular attention was given to the characteristics of the affected customer portfolio and the nature of the services operating within the managed environments.

Based on this assessment, the incident response team concluded that a blanket shutdown would introduce greater overall operational risk for the affected service portfolio than proceeding with immediate, controlled patch deployment while maintaining service availability.

This was a deliberate, time-sensitive and risk-based decision, based on an assessment of the affected customer environments and their service characteristics. It was not a general preference for availability over security.

The decision acknowledged that maintaining services during the initial remediation window involved a limited period of potential exposure. The response therefore prioritised immediate deployment of the relevant security fixes and minimisation of the time required to complete the initial remediation.

The decision was specific to the environments and circumstances assessed during this incident and does not represent a general policy of maintaining vulnerable services online.

Following the initial risk assessment, WAYSCloud initiated coordinated patch deployment across the identified affected environments.

The remediation scope included:

• Shared Hosting: PHP installations supporting customer websites and applications hosted on WAYSCloud-managed shared infrastructure.
• Managed Virtual Machines: Customer virtual machines for which WAYSCloud was responsible for operating system and runtime maintenance.
• Custom-Managed Services: Individually managed customer environments and services operating under dedicated management agreements or service-level agreements.

The initial remediation phase prioritised deployment of the relevant PHP security fixes, followed by verification of the updated runtime installations and functional checks of dependent services.

By approximately 16:00 CEST on Friday, 23 October, the identified affected PHP runtime installations within the managed scope had been updated and verified.

The completion of this phase established the foundation for further application-level remediation and compatibility testing.

Following completion of the initial runtime patching, WAYSCloud continued with a second, application-focused remediation phase.

This work addressed individual websites, PHP-based applications and dependent services requiring additional attention following the runtime security updates.

Activities included application-specific updates where necessary, compatibility assessments and functional testing.

The purpose of this phase was to verify that customer services remained operational and to resolve issues arising from the updated runtime environment.

The distinction between the two remediation phases is important:

The initial security patch deployment and runtime verification were completed within approximately two hours. The subsequent work focused on individual application compatibility, service-specific adjustments and additional functional verification.

The coordinated application-level remediation programme continued throughout Friday evening and Saturday morning.

All planned remediation and verification activities within the identified scope were completed by approximately 13:00 CEST on Saturday, 24 October 2026.

Customer communication formed an integral part of the incident response.

Affected customers were notified of the security event on Friday evening. Further notifications were provided following completion of remediation and verification activities for their affected services.

Customers were also encouraged to contact WAYSCloud during the weekend and throughout the following week if they experienced unexpected behaviour, compatibility problems or other operational issues following the security updates.

Given the criticality of the underlying vulnerabilities, all incident-related enquiries were automatically assigned Priority 1 (P1) handling and prioritised in accordance with the applicable service-level arrangements.

Fewer than ten customer enquiries were received in connection with the remediation activities.

This limited volume of follow-up requests was a positive operational indicator, although support request volume alone does not establish the absence of security exposure or application-level issues.

The coordinated response resulted in the following:

• Approximately two-hour initial remediation window: Relevant PHP security fixes deployed and verified across the identified affected managed runtime installations.
• Service continuity maintained: A blanket suspension of customer-facing services was avoided following a targeted operational risk assessment.
• Application-level remediation completed: Additional updates, compatibility work and functional verification concluded by approximately 13:00 CEST on 24 October.
• Customer communication completed: Affected customers received incident notifications and subsequent service-specific updates.
• Priority incident support: All incident-related enquiries were assigned P1 priority.
• Limited support impact: Fewer than ten customer enquiries were recorded in connection with the remediation activities.

The response covered multiple service delivery models, from shared hosting to individually managed customer infrastructure.

Critical vulnerabilities affecting widely deployed software require a coordinated response that considers technical severity, potential exposure, customer dependencies and the consequences of operational disruption.

This incident reinforced the importance of maintaining the capability to identify affected environments, deploy security updates across different service models and verify their operational effectiveness within a compressed response window.

It also demonstrated the role of customer-specific impact assessments in security decision-making.

A uniform shutdown policy may be appropriate in certain circumstances, particularly where immediate remediation is not possible or exposure cannot be adequately controlled. In this incident, following an assessment of the affected environments and available response options, WAYSCloud determined that immediate remediation without a blanket shutdown was the most appropriate course of action.

The response also highlighted the importance of distinguishing between infrastructure-level vulnerability remediation and subsequent application-specific compatibility work.

Both activities are necessary, but they serve different purposes and should be reported separately to provide an accurate account of remediation timelines.

The incident response initiated on 23 October 2026 required rapid coordination across technical operations, customer service and security decision-making.

By combining immediate patch deployment with a targeted risk assessment and structured application-level verification, WAYSCloud completed the initial security remediation within approximately two hours and the wider remediation programme within approximately 23 hours of incident activation.

Throughout the response, the objective remained consistent: address the critical security vulnerabilities as rapidly as possible while managing the operational consequences for affected customers responsibly.

WAYSCloud remains committed to transparent incident reporting, risk-based security management and continuous improvement of its operational resilience.

Published by: WAYSCloud Security Operations. Reporting period: 23–24 October 2026.

The following external sources provide further technical information about the vulnerabilities and the coordinated response.

• PHP — Official Security Releases, 21 October 2026
• NSM (Norwegian National Security Authority) — Oppdatert varsel: To kritiske sårbarheter i PHP
• NHS England — Critical Vulnerabilities in PHP (PHP2Shell)
• Ubuntu — PHP2Shell Critical Vulnerability Fixes
• NCSC Netherlands — PHP2Shell Operational Information