patch management

PHP2Shell is the nickname for two critical PHP runtime flaws, CVE-2026-109618 and CVE-2026-109619, disclosed in October 2026. Together they let an attacker run commands on a web server with one malformed request and no login. Exploitation started on 17 October, four days before PHP shipped fixes on 21 October.

This post walks the attack chain, the response that actually closes it, and the cleanup that patching alone never does. Everything here mirrors our free PHP2Shell RCE exercise, where you play both the attacker and the engineer on call.

Zero-day patch management is the process of closing a vulnerability that attackers are already exploiting, often before or within hours of a vendor fix. It covers four steps: install the fixed build, make sure the running service actually loads it, verify the exploit fails, and clean up anything the attacker reached while the hole was open.

Most teams are good at the first step. The other three are where incidents keep happening.