Summary: EVP Systems identified every server running PHP that we could find in our AWS environment and patched all four affected servers on October 21, 2026, the day PHP released its fixes. Any EVP service that ran on or relied on those servers was exposed until patching was completed. Our review of retained logs, selected files and AWS activity from October 17, 2026 through patching has not identified evidence of exploitation. No action is required from our clients.
What Happened
PHP is a programming language that runs a large share of the world’s websites, including WordPress sites and wikis. In October 2026, the PHP project disclosed two critical vulnerabilities in PHP itself, not in the applications built on it. The flaws were named PHP2Shell and are tracked as CVE-2026-109618 and CVE-2026-109619.
- October 17, 2026: exploitation attempts against the vulnerabilities were first reported publicly.
- October 20, 2026: the PHP security team announced that a security release would follow.
- October 21, 2026: PHP released fixes. EVP identified every affected server and patched all four the same day.
Details
The two vulnerabilities are rated 9.2 (critical) on the CVSS v4.0 scale. CVE-2026-109618 is a memory-handling flaw that occurs when PHP runs out of memory. CVE-2026-109619 is a use-after-free flaw, in which PHP keeps using memory it has already released, and it can expose data held in memory. Either one can let an unauthenticated attacker on the internet, with no login, run commands on a server with the privileges of the web process, or read secrets that process holds in memory, such as passwords and keys. The attack happens before a website’s own code runs, so it does not depend on what the website does.
The PHP project fixed the flaws in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and published source fixes for older versions. For more background, see Tenable’s PHP2Shell FAQ.
EVP uses PHP on our public corporate website, documentation sites, and development and internal hosts. Four servers ran vulnerable versions. We inspected every identifiable server in all enabled AWS regions, checking installed PHP packages and running processes. Four ran vulnerable PHP and fourteen had none.
Remediation
All four servers were patched on October 21, 2026 between 12:02 PM and 1:51 PM Pacific. One received the vendor’s standard security update. Three run PHP 7.4, which no longer receives public updates, so we built packages from the PHP project’s own official security fix. We confirmed the patched programs are the ones running, ran PHP’s regression tests against the patched build and reviewed every difference from baseline, and browser-tested the website and documentation sites afterward. The patched builds also exit a worker after memory exhaustion and disable upload-progress tracking, the interim mitigations PHP published.
Version numbers on these builds look older than the upstream fixed releases because they are distribution and custom backports. A scanner that reads only version numbers may flag them even though the fix is applied. We are replacing PHP 7.4 with a currently supported release and expect to complete the upgrade by November 30, 2026.
Review Status
Our review of retained logs, selected files and AWS activity from October 17, 2026 through patching has not identified evidence of exploitation. Some historical records, such as detailed process and network traffic records, were not available, so we cannot conclusively rule out compromise. We are completing the remaining checks and will update this page and notify affected clients promptly if that changes.
We are also contacting our vendors, including our cloud hosting provider, to confirm that their services are not affected. If we encounter any issues, we will update our clients accordingly.
Questions
If you have questions about EVP Systems’ handling of PHP2Shell, please contact our Compliance Department at compliance@evpsys.com.
A history of our responses to high-profile Internet vulnerabilities is always available on our website.