Security research

Patched the same evening, hunted the next morning

The FBI issued a critical alert for two flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) with a clear instruction: patch and hunt immediately. Official notices: the PHP announcement and the US CISA alert. PHP sits underneath most of the sites we look after.

That evening: patch

• Every server in the estate was checked for PHP and its exact version, and each supported install was upgraded to the fixed release.
• The published partial mitigation was applied wherever a fix could not land straight away. PHP's own advisory is clear that updating is the only complete fix.
• One client site on an end-of-life PHP version, which will never receive the fix, had its admin area locked to a single trusted network.
• A new detection rule now raises a critical alert, by text message within a minute, if any PHP process starts a shell.
• The firewall was tightened on a server with no PHP that can still reach production.
• The sweep also turned up an old auto-heal script still aimed at a server it no longer looked after. It was retired.

The next morning: hunt

• By breakfast it was headline news on the BBC, with government and council websites being taken offline while they patched. Our estate was already done.
• Every server running PHP was searched for signs of exploitation in the window before the fix: new or changed PHP files, web-shell code, tampered session files, shells or downloaders running under the web server, executables in temp folders, crypto-miners, new cron jobs, SSH keys or accounts, unusual outbound connections, altered system binaries and web-shell requests in the access logs. Nothing was found on any of them.
• The end-of-life site was taken offline that morning and replaced, within hours, by a rebuilt site with the same look, content and page addresses, but no PHP and no content management system left to attack. Its small admin area uses emailed one-time codes and locks out repeated guesses, and its enquiry emails pass SPF, DKIM and DMARC.
• While we were at it, one client's private email domain gained a backup nameserver on separate infrastructure and a stricter anti-spoofing (DMARC) policy, after its reports confirmed only its own server sends as the domain.

One security firm reported rediscovering the same flaw in a single evening with an AI model and a one-line prompt. The gap between a fix being published and bots using the flaw is now measured in hours, which is why the patch went on that evening and the hunt followed first thing the next morning.