How we handled the PHP2Shell vulnerability and the eMudhra certificate compromise

Two serious security problems landed in the same week of October 2026.

• PHP2Shell (CVE-2026-109618 and CVE-2026-109619): two flaws in PHP that let an attacker run code on a server with one request, no login needed. Fixes were released on October 21.
• The eMudhra exposure: eight signing keys belonging to a certificate authority could be recovered. Browsers blocked them within days, but any software with its own list of trusted issuers had to be updated separately.

Here is how we responded on October 22, in the order we did it.

1. 1. Find everything that runs the affected software.

   Not just the obvious web servers: every machine, every PHP version installed (including old ones nothing should use), and every runtime that keeps its own certificate list. Most of the risk in an incident like this sits in the things nobody remembers are there.

2. 2. Patch, then prove it.

   We installed the fixed releases and checked the installed version against the security advisory, not against "the update ran without errors". Is there a workaround? Not a complete one. Turning off PHP's session upload progress blocks the attack paths known so far, but the PHP team is clear that updating is the only full fix. On Ubuntu, a fixed PHP can still report an old-looking version number, so the advisory is the source of truth.

3. 3. Check what the patch touched.

   Updating shared software restarts the services that use it. We confirmed every service came back, then loaded every site and checked for errors.

4. 4. Update the certificate lists everywhere they live.

   The operating system has one; Node.js and the browser engine on our servers each carry their own. We updated all three and confirmed the compromised issuer is no longer trusted by any of them, and that our own certificates come from a different authority.

5. 5. Remove what we did not need.

   We found an old PHP version and an old Node.js version installed but unused. Software that is not running still needs patching, so we removed both.

6. 6. Write down what we learned.

   Including what surprised us, so the next response is faster.

Not running servers yourself? Here is what to do as a user.

Nobody had to ask us to do this. That is the part that matters: someone owns your software, watches for problems like these, and closes them before they reach you.

All posts