# php2shell PHP flaw: how Vodlix stayed ahead

**Source:** https://vodlix.com/blog/php2shell-vodlix-stayed-ahead  
**Summary:** Two critical PHP flaws, php2shell, went public on October 21, 2026. How Vodlix Shield, AI monitoring and an early patch protected every Vodlix cloud.  
**Published:** 2026-10-31  
**Publisher:** Vodlix

---

## Key takeaways

php2shell is two critical PHP flaws made public on October 21, 2026. Vodlix patched before the news broke, and customers did not need to do anything.

- Vodlix Shield filters requests in front of our systems, and our AI watches traffic for attack patterns.
- Every Vodlix cloud, and so every customer platform, is updated.
- Further hardening of our systems is planned.
- If you run PHP yourself, install the security update for your version now.

php2shell is the name researchers gave two critical flaws in PHP, made public on October 21, 2026. They could let an attacker run their own code on a web server, and sites around the world rushed to update. At Vodlix, our systems were protected and patched before the news broke, and our customers did not need to do anything.

## What is php2shell? {#what-is-php2shell}

php2shell is two related bugs in how PHP handles memory and errors, tracked as CVE-2026-109618 and CVE-2026-109619. Under the right conditions, an attacker could use them to run code on a server without logging in. The [PHP Foundation](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/) rated them critical and released fixes on October 21, 2026.

The disclosure moved fast. Exploit attempts climbed into the millions within hours, and some government and commercial sites went offline as a precaution, as [MediaNama reported](https://www.medianama.com/2026/10/223-php-vulnerabilities-global-rush-update/).

## How did Vodlix handle it? {#how-did-vodlix-handle-it}

We were protected on three fronts before anything could happen.

| What | What it does |
| --- | --- |
| Vodlix Shield | Filters incoming requests in front of our systems |
| AI monitoring | Watches our traffic for attack patterns |
| The patch | Applied before the flaws were made public |

Zain Jamil and our team patched the PHP in our middleware, the only part of Vodlix that uses PHP, ahead of the public release. Every Vodlix cloud, and so every customer platform, is updated. Customers did not need to take any action.

## What happens next? {#what-happens-next}

We have planned further hardening of our systems, so the next flaw like this meets more layers before it gets close. On a managed platform, security updates are our job, not yours.

## What should you do if you run PHP yourself? {#what-should-you-do-if-you-run-php-yourself}

If any of your sites run PHP outside Vodlix, act today.

1. Find every server and hosting plan that runs PHP, old sites included.
2. Install the security update for your PHP version, or ask your host to.
3. Read your providers' advisories, such as the [AWS security bulletin](https://aws.amazon.com/security/security-bulletins/2026-143-aws/).

If a site runs a PHP version that no longer gets security updates, plan the upgrade now.

## Want security handled for you? {#want-security-handled-for-you}

If you would rather have updates like this handled for you, see [what Vodlix runs for your platform](page:/features) or [request a demo](page:/demo). Security questions go to security@vodlix.com.

## Frequently asked questions

**Q: What is php2shell?**

php2shell is two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619, made public on October 21, 2026. Under the right conditions they could let an attacker run code on a web server without logging in.

**Q: Were Vodlix customers affected?**

No action was needed from Vodlix customers. We patched before the flaws were made public, and every Vodlix cloud, and so every customer platform, is updated.

**Q: What is Vodlix Shield?**

Vodlix Shield filters incoming requests in front of our systems, and our AI monitoring watches traffic for attack patterns.

**Q: What should I do if I run PHP myself?**

Install the security update for your PHP version, or ask your hosting provider to, and read your providers' advisories. Plan an upgrade for any site on a PHP version that no longer gets security updates.

**Q: How do I report a security issue to Vodlix?**

Email security@vodlix.com.