PHP's critical security release: what Upsun is doing
Blog post from Upsun
Upsun announced preemptive protections for all PHP applications on its cloud platform ahead of PHP’s 21 October 2026 release of fixes for two critical vulnerabilities, reportedly CVE-2026-109618 and CVE-2026-109619, each rated 9.2 under CVSS v4.0 and informally called “php2shell.” No exploitation has been reported, and PHP has said technical details, affected versions, and fixes will be published with the release, though it may issue patches earlier if details leak or attacks begin. Upsun has deployed edge-level mitigations and plans to update its PHP runtime images promptly after the upstream patches become available, with rollout information to be maintained in its developer center and status page. PHP’s supported branches, versions 8.2 through 8.5, will receive upstream fixes, while end-of-life versions 8.1 and earlier may remain unpatched despite Upsun’s mitigations, prompting the company to recommend that affected users upgrade and test newer PHP configurations before deployment.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.