Fix The Latest PHP Vulnerabilities With Phased PHP Modernization Services
PHP2Shell is being exploited. Not sure if you are exposed, or how to fix it? We will show you in 30 minutes.
On October 21, 2026, the PHP project released emergency fixes for two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and known as PHP2Shell. Both allow remote code execution without logging in, both score 9.2 on CVSS v4.0, and security researchers have reported attacks in the wild.
If you cannot tell whether your applications are exposed, or you cannot upgrade this week, you are not alone. Cabot helps SaaS teams find the exposure, reduce the risk now, and then upgrade PHP or migrate to another language in phases, so the next advisory is a patch, not a crisis.
Not sure how to fix it? Tell us your PHP version
A Cabot architect replies within one business hour.
Are You Exposed To The Latest PHP Vulnerabilities And Unsure How To Fix Them?
These are the six challenges we hear most from engineering leaders right now. Each one comes with the way Cabot solves it.
We do not know which systems are exposed
The challenge. PHP runs in more places than most teams track: web servers, containers, build images, hosting panels and inside vendor software. The php -v command reports the command line binary, which can differ from the one serving your site.
How Cabot solves it. Cabot inventories every PHP runtime in your environment, checks the version that actually serves traffic against the package changelog, and hands you a ranked exposure map with internet-facing systems first.
We run PHP 8.1 or older and there is no official fix
The challenge. PHP did not release patches for 8.1 and older. It published minimal source backports for 7.4, 8.0 and 8.1, and some vendors backport fixes, but nothing replaces a supported version.
How Cabot solves it. Cabot moves you to a supported PHP version in a focused sprint, updating dependencies and tests as we go. Where a move cannot happen this month, we help you choose a safe interim path and plan the upgrade.
We patched, but running workers and containers may still be old
The challenge. Installing a package does not patch a running process, and a container patched in place is vulnerable again when the image is rebuilt. Backported fixes can also keep the old version number, which confuses scanners.
How Cabot solves it. Cabot rebuilds images, restarts every worker, and verifies the runtime that serves requests, so you know the fix is live and not only installed.
We cannot upgrade this week
The challenge. PHP states that no configuration change fully mitigates these flaws. Stopgaps such as turning off session upload progress, setting request size limits or filtering at the edge reduce risk, but they can break applications under memory pressure.
How Cabot solves it. Cabot applies the stopgaps your PHP version and setup call for, tests them under load, and sets a short path to the real fix, so interim measures do not become permanent.
We do not know whether someone is already inside
The challenge. A patch closes the hole. It does not remove access an attacker already gained. Security teams advise checking for unusual multipart requests followed by memory errors, oversized session cookies, unexpected files and processes, and strange outbound connections.
How Cabot solves it. Cabot reviews your logs and hosting setup alongside your security team, flags what looks wrong, and helps you plan rotation of the database credentials and API keys the PHP process could read.
Every upgrade breaks something, so it keeps slipping
The challenge. Without tests, abandoned packages and frameworks that dropped support for older PHP make each upgrade a gamble, so the next advisory finds you in the same place.
How Cabot solves it. Cabot modernizes service by service with tests and automated dependency checks. Upgrades become routine, and the next advisory is a patch, not a project.
Tell us your PHP version and where it runs. We will tell you which of these challenges apply to you.
How Can You Check Your PHP Exposure In Five Minutes?
Five questions any engineering lead can answer today. A yes or a not sure on any of them means a review is worth thirty minutes.
Which PHP versions serve your traffic?
Check the runtime behind your web server or FPM pool, not only the command line.
Is any version below 8.2.35, 8.3.36, 8.4.27 or 8.5.12?
Those branches received the fixes on October 21, 2026.
Do you run PHP 8.1 or older?
The PHP project released no official patch for them.
Were containers rebuilt and workers restarted?
A package update alone does not patch running processes.
Does Apache mod_php serve any application?
Security advisories describe it as the highest risk setup.
Did anyone check for signs of compromise?
Patching closes the hole. It does not remove an intruder.
How Does Cabot Take You From Exposed To Prepared?
Three stages, each ending in a decision that stays with you. You never commit to the next stage before the last one proves its value.
Where is your PHP exposed?
We inventory runtimes, versions, dependencies and what is publicly reachable, then recommend upgrade in place, phased migration, or leaving a component alone for now.
How do you reduce the risk this quarter?
We move you to a supported version, rebuild and restart, tighten configuration and check for signs of compromise, in a small sprint with a fixed scope.
How do you stop it coming back?
We modernize service by service, add tests and automated dependency checks, and set an upgrade cadence so the next advisory is routine.
Should You Upgrade PHP Or Migrate To Another Language?
The answer depends on your team, your product and your roadmap, not on fashion. We assess first, then recommend the lightest path that removes the risk.
| Migration path | When it fits | What changes |
|---|---|---|
| Upgrade in place to a current PHP version | Your code is sound and your framework still has a supported release | PHP version, dependencies and tests. The product keeps its shape |
| Move to a modern PHP framework such as Laravel or Symfony | You run CodeIgniter, CakePHP, Zend or custom code that has become hard to extend | Framework and structure, with business logic carried over in phases |
| Migrate to Node.js and TypeScript | Your team is shifting to a JavaScript stack, or you want one language across front end and back end | Back end rebuilt service by service behind your existing APIs |
| Migrate to Java with Spring or to .NET | You need enterprise integration, strict typing or alignment with an existing platform | Services move gradually, with PHP and the new stack running side by side |
| Migrate to Python | Data, AI or analytics workloads are becoming the core of the product | Selected services move first, starting with those that gain most |
| Leave a component alone for now | The component is stable, isolated and low risk | Nothing, until the assessment says otherwise |
Running more than PHP?
The same assess, mitigate and prevent approach applies to other legacy stacks, including the ones below.
Plan my migration pathWhat Do You Walk Away With After The Review?
The assessment ends with decisions you can take to your leadership team, not a stack of findings nobody has time to read.
An exposure map
PHP versions, frameworks, dependencies and what is publicly reachable, ranked by risk.
A clear recommendation
Upgrade in place, migrate in phases, or leave alone for now, with the reasoning shown.
A phased roadmap with estimates
Costs and timing per phase, plus a first 30 day plan your team can start from.
A leadership summary
A short, plain-language brief for your board or executive team.
Ready To Stop Worrying About The Next PHP Advisory?
Book a 30 minute call with a Cabot architect. Bring your PHP version and your biggest worry, and leave with a clear next step.
Schedule your architect callHow Does The Engagement Work, And When Do You Decide?
Four steps, each with a decision point. You can stop after any of them.
Review: a 30 minute call
We talk through your stack, hosting, team and what worries you most. Decision: does a deeper assessment make sense?
Assessment: about two weeks
We review code, dependencies and infrastructure, with AI-assisted analysis and an engineer reading every result. Decision: upgrade or phased migration?
Mitigation: a focused sprint
We move you to a supported version and harden what is exposed. Decision: what scope, and in what order?
Prevention: phased modernization
We modernize service by service, with tests and dependency checks added as we go. Decision: which service moves next?
Why Choose A Phased Approach Over A Rewrite-First Vendor?
The right partner tells you what not to rebuild. Here is how the two approaches differ on the points a CTO weighs.
| Dimension | Rewrite-first vendor | Cabot |
|---|---|---|
| Starting point | Proposes a rebuild before reading the code | Assesses first, then recommends upgrade, migrate or leave alone |
| Roadmap impact | Freezes feature work during the rewrite | Moves service by service while your product keeps shipping |
| Security | Treated as a later phase | Mitigation comes first, then prevention |
| Estimate | One large number, hard to challenge | Phased estimates you can approve one stage at a time |
| Your engineers | Sidelined or replaced | Paired with Cabot, with documentation left behind |
| Commitment | Long contract up front | A decision point after every stage |
Where Does AI Help In A PHP Migration, And Where Does It Stop?
AI is useful for the slow parts: reading unfamiliar code, mapping dependencies, drafting tests and proposing refactors. It is not a substitute for judgment. Your architecture and every release decision stay with senior engineers.
Model neutral
We choose the tools that fit your codebase and swap them as better ones appear.
Human review before merge
An engineer reads and approves every change before it reaches your repository.
No training on your code
Your source code and data are never used to train a model.
Is A PHP Review The Right Fit For Your Team?
We would rather tell you now than waste your thirty minutes.
A good fit if
Your core product runs on PHP 7 or older, or on an aging Laravel, Symfony, CodeIgniter, CakePHP or Zend app, and you lead engineering at a software company with a team to protect and a roadmap to keep.
Probably not a fit if
You run a small WordPress marketing site, you are a student or job seeker, or you want incident response for an active breach. Cabot fixes the application. Your security team or an incident response firm handles the intrusion.
What Has Cabot Delivered For Software Teams?
Cabot has built and modernized regulated, integration-heavy software for more than a decade. These examples show the engineering behind the work. They are not PHP projects.
AI-Accelerated Discovery to MVP for a HIPAA-Compliant Patient and Physician Marketplace
A four-portal telehealth marketplace taken from discovery to a working MVP.
Text2SQL with Streamlit
A Streamlit app that turns plain-English questions into SQL for faster analysis.
FHIR Server and FHIR Auth Configuration for Secure API Access
A FHIR-compliant server with OAuth2 and OpenID Connect for secure healthcare data access.
Frequently Asked Questions
Is PHP2Shell really being exploited?
Security researchers, including watchTowr, have reported exploitation in the wild since the October 21, 2026 release. Researchers still disagree on how reliably the public exploits work against a default install, so treat patching as urgent.
How do I know whether my PHP version is vulnerable?
Fixes shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and anything older is exposed. Check the runtime that serves traffic, not only the command line, and read your package changelog, since vendors can backport a fix without changing the version number.
We run PHP 8.1 or older. What are our options?
The PHP project released no official patch for 8.1 and older. Options are a vendor package with a backported fix, a minimal source backport for 7.4, 8.0 or 8.1, or moving to a supported version, which is the lasting answer. The assessment helps you choose.
Can we fix this without upgrading?
Stopgaps such as turning off session upload progress and limiting request sizes reduce risk, but PHP states that no configuration change fully mitigates these flaws. Updating, rebuilding images and restarting workers is the complete fix.
Do we need a rewrite, and can you migrate us to another language?
Often not a rewrite. Many applications can be upgraded and modernized in phases, replacing the riskiest parts first while your product keeps shipping. When another language is the better fit, such as Laravel, Node.js, Java, .NET or Python, we migrate service by service and run both side by side. The assessment tells you which path fits.
How long does the assessment take, and what does it cost?
About two weeks for most applications, after a 30 minute review call. Cost depends on how many services are in scope, how much test coverage exists, and how far your versions have drifted. The assessment ends with phased estimates you can approve one stage at a time.
Do you sign an NDA, and can we keep shipping features?
Yes to both. An NDA is signed before any code is shared, and we work in phases beside your engineers, one service at a time, leaving documentation behind.
Does Cabot replace our security team or incident response?
No. Cabot fixes the application side: inventory, upgrade, hardening and modernization. If you suspect an active breach, bring in your security team or an incident response firm, and we will work with them.