# PHP2Shell.io

> PHP2Shell.io is an independent technical resource by miglen.com for CVE-2026-109618 and CVE-2026-109619: patch guidance, temporary compensating controls, monitoring, exposure checks, and credited research.

Content review snapshot: 2026-10-21. This static snapshot is not a live advisory feed. Primary PHP and package-vendor advisories establish vulnerability scope and patch coverage.

Patching the PHP runtime is the recommended remediation. PHP INI changes and edge filters are partial controls for specific paths, not complete fixes. An HTTP status, failed PoC, or absence of alerts cannot establish that a deployment is safe. The published CVSS v4.0 score of 9.2 describes vulnerability severity; it is not a personal deployment risk score.

Configuration and lab examples were reviewed against documentation and source. They were not deployed or validated through exploit execution. Original findings remain attributed to their authors on the Read page.

## Guides

- [Overview](https://php2shell.io/): Vulnerability anatomy with upstream code diffs, recommended actions, fixed releases, and the CVSS score explanation.
- [Patch](https://php2shell.io/patch.html): Recommended remediation: update PHP, replace workers, and verify the live web runtime.
- [Control](https://php2shell.io/controls.html): Temporary, partial controls for PHP, Apache, nginx, AWS WAF, lighttpd, Cloud Armor, and Cloudflare.
- [Detect](https://php2shell.io/detection.html): Request, runtime, process, network, and WAF monitoring with investigation caveats.
- [Exploit](https://php2shell.io/pocs.html): Exploit lifecycle diagrams, exposure checks, benign curl probes, public research repositories, and isolated-lab limitations.
- [Read](https://php2shell.io/references.html): Primary PHP advisories, credited research, community repositories, and configuration documentation.

## Text and provenance

- [Complete site text](https://php2shell.io/llms-full.txt): Generated from the main content of all six HTML guides, including configuration snippets and source links.
- [Content review record](https://php2shell.io/data/content-review.json): Review date, methodology, corrections, and limitations.
- [Maintainer](https://miglen.com/): The person behind this independent resource.

## Optional

- [Sitemap](https://php2shell.io/sitemap.xml): Canonical public guide URLs.