Other

PHP2Shell Defense Playbook: The AI-Found Bug That Shook 70% of the Web

The problem

On October 21, 2026, PHP shipped emergency patches for two critical flaws (CVE-2026-109618 and CVE-2026-109619) that let an attacker run code on a server without logging in. PHP powers about 70% of the websites whose server-side language is known. Governments, banks, broadcasters and platforms took sites offline as a precaution.

If you run a website, look after client sites, manage servers, or depend on vendors that use PHP, you are now asking: Am I affected? What exactly do I change on my stack? How do I prove it worked? What if I don't run PHP? The advice is scattered across dozens of blog posts, vendor notices and news articles, and much of it is written for experts. The wrong move, such as updating a plugin and stopping there, leaves you exposed.

The solution

PHP2Shell Defense Playbook is a complete, step-by-step guide in a clean Notion workspace. It explains the bug in plain English, shows how AI found it, and gives you exact fixes by PHP version, operating system, web server, framework, CMS and hosting type, plus a full AI-powered audit method. Every page is written so a non-technical owner can follow it and an engineer can copy-paste from it.

How easy and convenient it is

Start in 15 minutes: a "Start Here" triage page walks you through 7 timed steps from "do I run PHP?" to "patched and verified".
Simple words first: every page opens with an "In plain English" box, then adds the technical detail.
Find your path fast: decision tables send you straight to the fix for your exact setup.
Copy-paste ready: commands, config snippets, checklists, and email templates you can use immediately.
Always accessible: read it in your browser on any device, no downloads, no software to install.
Honest about sources: facts are labelled Confirmed, Reported or Analysis, with a full source list.

What you get (150+ pages across 10 sections)

Start Here: the 15-minute emergency triage, copy-paste emergency commands, message templates, and a "how to use this book" guide by role.

Chapter 1, What Is the Bug: the bug explained with everyday analogies, the four underlying flaws, who is affected, a timeline, myths vs facts, and a self-check quiz.

Chapter 2, How AI Found It: why careful humans missed it for more than a decade, how AI-assisted teams found and proved it, and lessons for defenders.

Chapter 3, Other Programming Languages: the bug family, a language-by-language risk map, an honest probability assessment, and what to check in non-PHP stacks.

Chapter 4, The Outage Register: 100 numbered entries with name, domain and a one-line detail: every reported outage and precautionary shutdown with a confidence tier, plus an atlas of well-known PHP platforms (clearly labelled as exposure, not outages).

Chapter 5, The Fix Master Guide: exact fixes by PHP version, OS and control panel, web server, framework, CMS and hosting type, emergency mitigations, and post-patch verification and compromise hunting.

Chapter 6, If You Don't Run PHP: how to find hidden PHP, check vendors and appliances, and harden other stacks against the same bug class.

Chapter 7, Audit With AI: a 9-step audit method with Claude, Claude Code, ChatGPT and Codex, Gemini, Perplexity and Copilot, a 25-prompt library, and a report template.

Chapter 8, Pro Tips and Insider Playbook: patch operations, hardening, monitoring recipes, incident response, an agency playbook, 25 common mistakes, a 30-question FAQ, and a 30/60/90-day roadmap.

Appendices: one-page cheat sheet, checklists, config snippets, commands by OS, a 50-term glossary, templates, sources, and a disclaimer.

Complete table of contents

Start Here: The 15-Minute Emergency Triage
- Copy-Paste Emergency Commands
- Message Templates: What to Tell Your Host, Boss and Clients
- How to Use This Book
Chapter 1: What Is the PHP2Shell Bug? (In Plain English)
- 1.1 The 60-Second Version
- 1.2 PHP in Plain English
- 1.3 Memory, Crashes and "Use-After-Free"
- 1.4 CVE-2026-109618, Explained
- 1.5 CVE-2026-109619, Explained
- 1.6 From Bug to "Shell"
- 1.7 Who Is Affected?
- 1.8 The Timeline
- 1.9 Myths vs Facts
- 1.10 Self-Check Quiz
Chapter 2: How AI Found It, and Why Humans Missed It for More Than a Decade
- 2.1 Why Humans Missed It
- 2.2 How the AI Hunt Worked, Step by Step
- 2.3 AI vs Human: Who Did What
- 2.4 The Race: Leak, Honeypot and Exploit Attempts
- 2.5 What Changed: The AI Inflection Point
- 2.6 Lessons for Defenders
Chapter 3: Could This Happen in Other Programming Languages?
- 3.1 The Bug Family
- 3.2 Language-by-Language Risk Map (C/C++, Python/Ruby/Perl/Lua, Node.js, Java/JVM, Go, Rust and Swift, .NET, The Logic Version)
- 3.3 How Likely Is It? An Honest Probability Assessment
- 3.4 What to Do in a Non-PHP Stack
- 3.5 Predictions: The Next 24 Months
Chapter 4: The Verified Outage Register: Who Went Dark
- 4.1 How to Read This Register
- 4.2 Europe: Governments, Public Bodies and Universities
- 4.3 Asia-Pacific and North America
- 4.4 Companies, Transport and Finance
- 4.5 Media, Platforms, Communities and Nonprofits
- 4.6 Games and Online Services
- 4.7 The Exposure Atlas (4.7a CMS, E-commerce and Hosting Tools; 4.7b Frameworks, Apps and Tools)
- 4.8 What the Outage Wave Teaches You
Chapter 5: The Fix Master Guide
- 5.1 Fix by PHP Version (8.5/8.4/8.3/8.2; 8.1/8.0/7.4 backports; 7.x and 5.x; choosing your destination; known post-patch issues)
- 5.2 Fix by Operating System, Container and Control Panel (Ubuntu and Debian; RHEL, AlmaLinux, Rocky and Remi; Alpine; Docker, Compose and Kubernetes; cPanel, CloudLinux, Plesk, DirectAdmin; Windows and macOS; building from source)
- 5.3 Fix by Web Server (Apache with mod_php; Apache with PHP-FPM; Nginx; LiteSpeed; IIS; Caddy and FrankenPHP; CDN/WAF layer)
- 5.4 Fix by PHP Framework (the one rule; Laravel; Symfony; CodeIgniter, CakePHP, Yii, Slim, Laminas; Swoole, RoadRunner, Phalcon; checklist)
- 5.5 Fix by PHP CMS and Application (WordPress and WooCommerce; Drupal; Joomla; Magento, PrestaShop, OpenCart, Shopware; TYPO3, Craft, Concrete CMS, October, Grav; MediaWiki, Moodle, phpBB, MyBB, Flarum; Nextcloud, Roundcube, phpMyAdmin, WHMCS, Matomo; compatibility checks)
- 5.6 Fix by Hosting Type (shared; managed WordPress; VPS and dedicated; cloud IaaS and PaaS; containers and Kubernetes; serverless and edge; "ask your host" email templates)
- 5.7 Emergency Mitigations When You Can't Patch Today (the 12 interim settings; multipart limits at the edge; resource limits; when to go offline; what not to do; rolling back)
- 5.8 After Patching: Verify, Restart, Rotate, Hunt (prove it's patched; restart matrix; rotate secrets; hunt for compromise; the first 60 minutes; document and report)
Chapter 6: If You Don't Run PHP: What to Check Anyway
- 6.1 Find the PHP You Didn't Know You Had
- 6.2 Your Vendors and SaaS Dependencies
- 6.3 Appliances and Bundled PHP
- 6.4 Same Bug Class, Other Stacks
- 6.5 Edge and Network Controls
- 6.6 Secrets and Blast Radius
- 6.7 Monitoring, Logging and Alerting
- 6.8 Incident Readiness
- 6.9 The 30-Minute No-PHP Checklist
- 6.10 Twenty Questions to Ask Any Vendor
Chapter 7: Audit Your Website with AI, Step by Step
- 7.1 Ground Rules: Audit Safely
- 7.2 The Audit Method in 9 Steps
- 7.3 Audit With Claude: Chat and Projects
- 7.4 Audit With Claude Code
- 7.5 Audit With ChatGPT and OpenAI Codex
- 7.6 Audit With Google Gemini
- 7.7 Research and Verify With Perplexity
- 7.8 Audit With Microsoft Copilot and GitHub Copilot
- 7.9 AI Plus Scanners: The Combination That Wins
- 7.10 The Prompt Library: 25 Copy-Paste Prompts
- 7.11 Cross-Checking AI With Multiple Models
- 7.12 The Audit Report Template
- 7.13 Mini Case Study: Auditing a WordPress + Nginx + PHP-FPM Site
Chapter 8: Pro Tips and Insider Playbook
- 8.1 The Patch-Operations Playbook
- 8.2 php.ini and FPM Hardening Reference
- 8.3 Containers, CI/CD and Image Hygiene
- 8.4 Monitoring and Detection Recipes
- 8.5 The "Never Again" Architecture
- 8.6 Incident Response: The First 60 Minutes
- 8.7 Freelancer and Agency Playbook
- 8.8 The 25 Mistakes People Make
- 8.9 Insider Notes: What the Press Release Doesn't Tell You
- 8.10 FAQ: 30 Questions, Answered
- 8.11 The 30/60/90-Day Hardening Roadmap
Appendices
- A. One-Page Cheat Sheet
- B. Checklists
- C. Config Snippet Reference
- D. Command Cheat Sheet by OS
- E. Glossary: 50 Terms in Plain English
- F. Templates
- G. Sources and Further Reading
- H. Disclaimer and How to Keep This Book Current

Who this is for

Website owners and founders who need to know what to do today
Freelancers and agencies protecting client sites
Sysadmins, DevOps engineers and developers who need exact commands
Teams that "don't run PHP" but rely on vendors, appliances or hidden PHP

Good to know

Facts are as of October 23, 2026 and come from public sources listed in the book; vendor status changes quickly, so check php.net and your vendor. Public reporting does not name 100 shut-down websites, so Chapter 4 labels every entry honestly (reported outage versus exposure atlas). This is an educational guide, contains no exploit code, and is not legal or professional security advice. Access is delivered as a Notion link inside your purchase content.