How Upsun handled PHP2Shell: protection in place 22 hours before the patch
Blog post from Upsun
Upsun reported that it protected its cloud customers from the critical PHP2Shell vulnerabilities nearly 22 hours before PHP released emergency fixes on 21 October 2026 by deploying edge-layer web application firewall rules across all regions. The flaws could allow unauthenticated attackers to take control of affected websites, and CMS or plugin updates alone would not address them because remediation required PHP updates. After observing automated scanning and attacks, which its rules blocked at roughly 1,700 malicious requests per hour, Upsun proactively tested and deployed PHP patches without changing customer code or configurations, using brief request-holding refreshes to minimize disruption. It completed patches for supported PHP versions the same day, extended updates to older versions where fixes were available, and directly contacted customers whose environments could not be automatically updated or were too old to patch. The company attributed its response to centralized edge protection, in-house PHP maintenance, proactive patching procedures, and separated engineering and communications roles, while advising customers on unsupported PHP versions to plan upgrades despite the added protective measures.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.