Two unauthenticated PHP remote-code-execution flaws went public with attacks already running. We closed them across more than 500 customer servers: load-balanced clusters, cPanel, Plesk and ISPConfig. Some servers ran PHP versions with no official fix. No customer site went down.
October 2026 · 3 min read
SECTOR
Managed hosting and support customers
SCALE
500+ servers
PLATFORM
Load-balanced PHP clusters, cPanel, Plesk, ISPConfig
ENGAGEMENT
Emergency security response
Servers patched or mitigated
Minutes of customer downtime
Control panels: cPanel, Plesk, ISPConfig
Scroll the diagram sideways to see all of it →
Clusters were patched node by node. Panel servers, which have no load balancer, got a graceful PHP-FPM reload instead.
Critical, unauthenticated and already exploited. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets an attacker run code on a PHP server with one crafted upload request, before any application code runs. Details leaked a day early and attacks started before the fixed releases were out. Our customers had more than 500 internet-facing PHP servers, and some ran PHP versions that would never get an official patch.
Mitigate everywhere first, then patch in waves. Within the first hours, every server received an interim mitigation: session upload progress switched off in every PHP-FPM pool, which closes the path used by CVE-2026-109618. It does not fix CVE-2026-109619, but it bought time while patching ran. Custom scripts handled the inventory, the rollout and the checks, so 500+ servers could be worked through in parallel without anyone logging in to each one.
The fix was already in the PHP source, so we built the packages ourselves rather than wait for them.
No official package for every server. On release day Remi and several OS vendors had not yet shipped fixed packages. For servers that could not wait, we built our own RPMs from the fixed PHP source, keeping the vendor’s file layout so that nothing else changed. They are versioned so that the official packages replace them automatically. For PHP branches upstream no longer supports, we backported the fix wherever the code allowed it.
Two critical PHP RCEs, exploited before release, across 500+ servers on clusters and three control panels.
Interim mitigation fleet-wide, rolling updates behind the load balancers, in-house RPMs and backports where packages lagged.
Every server patched or mitigated, with no customer downtime.
Patched without a maintenance window. More than 500 servers were brought to a fixed or backported PHP, or left mitigated with a dated upgrade plan where no safe backport existed. No customer site went down. The in-house builds are replaced by the official packages through normal updates as they arrive.
We patch fleets the same day: mitigation first, then rolling updates without taking your sites down.
