! PHP2Shell Watch
Incident mode active
Production status

Site under lockdown.

We’re keeping the doors shut while the PHP engine gets patched for CVE-2026-109618 and CVE-2026-109619.

Read Sansec’s research What’s happening?
Locked down
Two workers clean up a manure pile Two stick figures wearing hard hats use pitchforks to work on a large brown pile.

Patch pending. Visitors paused.

The site will return after the fixed PHP release is installed and the deployment is verified.

Containment active

The short version

A little manure now beats a lot of cleanup later.

01 / WHY

Critical PHP exposure

These vulnerabilities target PHP itself, before normal site code and application defenses can help.

02 / ACTION

Patch the engine

The durable fix is an infrastructure-level PHP update to a release that explicitly contains both fixes.

03 / RETURN

Verify, then reopen

After the patch: restart the web service, confirm the web SAPI version, and run a clean smoke test.