PHP2Shell Patch and PHP 8.4 / 8.5 Upgrades for Laravel and WordPress

PHP2Shell (CVE-2026-109618, CVE-2026-109619) patched on a real Laravel 13 API: PHP 8.4.27, 110/110 tests and 19/19 API checks passing, plus 10 PHP security and upgrade jobs I deliver.

8.4.27patched PHP release, 21 Oct 2026, fixes PHP2Shell

9.2CVSS v4 score of CVE-2026-109618 and CVE-2026-109619

110 / 110PHPUnit tests passing after the patch

19 / 19API smoke tests passing on the patched server

7.1 → 8.4same app, earlier upgraded from Laravel 5.7 to Laravel 13

What happened to PHP this week

On 21 October 2026 PHP shipped emergency releases for PHP2Shell, two critical flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) that let an attacker run code on a server without logging in. Every PHP version from 5.4 to 8.5 is affected. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Attempts to exploit it were seen days before the fix, and scanners count millions of exposed PHP sites.

Two days later PHP published a further advisory, CVE-2026-115560, which the 21 October releases do not fix. It only affects apps that change the session serializer at runtime, and the advised stopgap is the same: turn off session upload progress until the next patch.

If you run PHP 8.1 or older (WordPress on old hosting, Laravel 5 to 8, custom apps), there is no patch for your version. The only fix is an upgrade to a supported branch, 8.2 to 8.5.

Real work: patching and upgrading a Laravel API

Go Doc is a doctor-on-demand platform (doctor app, patient app, web client and API) I first built in 2018 on Laravel 5.7 and PHP 7.1. In 2026 I modernised it to Laravel 13 on PHP 8.4, and on 24 October 2026 I patched it for PHP2Shell.

Upgrade, 2026. Laravel 5.7 to 13 and PHP 7.1 to 8.4, Passport 13 for auth, dead packages replaced, hardcoded keys removed from the code, Docker setup with MySQL 8.4. API route names were kept exactly as they were, because three client apps depend on them.
PHP2Shell patch, 24 October. The Docker base image is pinned to php:8.4.27, so a cached older 8.4 image can never come back. Composer's platform version follows it, so dependencies resolve for the patched runtime.
Defence in depth. session.upload_progress.enabled=0, which also covers the not-yet-patched CVE-2026-115560, and expose_php=Off, so the server stops advertising its PHP version.
Proof it still works. php -v reports 8.4.27, all 110 PHPUnit tests pass (317 assertions) and all 19 API smoke tests pass, run against the rebuilt container.

10 PHP jobs I can do for you now

Emergency PHP2Shell patch

Problem: your servers run PHP below 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

What you get: every server, container and cPanel account found and patched, upload progress turned off as a stopgap, and a short report of what was changed where. Usually done within 24 hours.

Upgrade from PHP 5, 7, 8.0 or 8.1

Problem: old PHP gets no security fixes at all, PHP2Shell included.

What you get: the app moved to PHP 8.4 or 8.5, deprecated code fixed, tests added where none exist, and a rollback plan.

Laravel version upgrade

Problem: Laravel 5 to 9 apps are stuck on old PHP.

What you get: the same jump I did on Go Doc, Laravel 5.7 to 13: packages replaced, auth migrated, API kept stable for your apps.

WordPress and WooCommerce compatibility

Problem: the host updated PHP and the theme or a plugin broke, or you cannot update because it would.

What you get: a staging copy on the new PHP, broken plugins fixed or replaced, then a calm switch on the live site.

Was I hacked? Compromise check

Problem: PHP2Shell was exploited before the fix came out.

What you get: web logs and files checked for exploitation signs and web shells, changed files compared with a clean copy, credentials rotated if needed.

Docker and CI that cannot drift

Problem: images built from php:8-latest or a cached tag quietly stay vulnerable.

What you get: pinned image versions, automatic update pull requests when PHP releases a fix, and tests that run before anything ships.

Composer dependency audit

Problem: vulnerable packages are as dangerous as old PHP.

What you get: composer audit plus a check of which issues your code can actually reach, packages updated and tested, abandoned ones replaced.

PHP server hardening

Problem: default php.ini and PHP-FPM settings give an attacker more than needed.

What you get: session, upload, error-display and function settings tightened, version headers hidden, FPM pools separated per site.

Move off old shared hosting

Problem: the host cannot give you a patched PHP version.

What you get: migration to a managed host or containers on AWS or GCP, on a current PHP, with no downtime and the database moved safely.

Monthly PHP maintenance

Problem: the next PHP2Shell will come, and nobody is watching.

What you get: a monthly patch window, security advisories watched for you, updates tested on staging first, and a one-page report each month.

How I work: changes go to a staging copy first, with your backups checked before anything touches production. I report exactly what was patched, what was tested and what was not.

How a project runs

15-minute check: PHP version, framework, hosting and what the site does.
Patch or plan: an emergency patch the same day, or a written upgrade plan with a fixed price.
Staging first: the change is tested on a copy, with your tests or ones I add.
Live switch and report: deployed at a quiet hour, verified, and documented.

Packages

	Emergency patch	PHP upgrade	Laravel or WordPress upgrade
Scope	Up to 3 servers or sites	One app to PHP 8.4 or 8.5	Framework jump, tests, deployment
You get	Patched PHP, stopgap settings, report	Upgraded app, fixes, rollback plan	Upgraded app, stable API, staging and live
Time	24 hours	3 to 7 days	1 to 3 weeks
From	$150	$600	$1,500

Sources: PHP security releases of 21 October 2026; advisories from Datadog Security Labs, Palo Alto Unit 42, Google Cloud and watchTowr.