PHP2Shell: a critical issue on a large part of the web.

Clients wrote this week and asked whether the PHP news reached the systems we ship.

Two bugs in the PHP runtime

On October 21, PHP published fixes for two critical bugs in the runtime, CVE-2026-109618 and CVE-2026-109619. CISA calls the pair PHP2Shell. On a PHP installation that serves web requests, they can allow unauthenticated remote code execution. That is a serious bug for a huge part of the web. PHP still runs a great many sites, shops, and tools, so a flaw in the runtime is not a niche story.

CISA, as of the October 23, 2026 update, had not confirmed successful exploitation in the wild. That does not make the bugs small. They are critical, and the exposure is PHP. Anyone serving the web with that runtime has a real fix to apply.

An old decision

The systems we design don't include a PHP runtime. The systems we design are built with Next.js, React, and TypeScript, Payload CMS, and MongoDB, and media is stored on AWS S3. A request is handled by Next.js. The interface is React. The code is TypeScript. Content is modeled in Payload and stored in MongoDB. Files for media live on AWS S3. We settled on that shape a long time ago, in part so a failure in a runtime we don't run would have nowhere to land.

This isn't a claim that the work is finished or that nothing else can go wrong. Other bugs will show up, in dependencies we do run, in configuration, and in the ordinary mistakes of building software. It means this particular class of bug has no process to enter. The security is in the shape of the system, chosen early, not in a patch we scrambled to add this week.

When the notes arrived, we compared them with the architecture we already had. The question was whether the stack still matches the decision we made when we chose it, and we're happy that it does.