PHP2Shell: Two Critical PHP Bugs, Happening Now Live - 👀 WMW 357

Written by: Shahbaz Latif Created: 21 October 2026

Category: Watch Me Work Live Streams

New!Hits: 4Reading time: 03:41

Watch me Work Live Streams Joomla 6

This morning PHP released fixes for two critical vulnerabilities nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both are rated CVSS 9.2 and allow unauthenticated remote code execution, and they're in PHP itself, so every Joomla and WordPress site is affected until its server is patched. Today on Watch Me Work I'm patching my own hosting servers live and showing you how to check yours. The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older get no fix at all, and roughly one in five sites still runs one of those versions. Here's what I'll cover live:
✅ What PHP2Shell is, in plain English, and why "unauthenticated RCE" is as bad as it gets
✅ How to check whether your site is affected: Joomla System Information, cPanel MultiPHP Manager and mySites.guru
✅ How the fix reaches you on shared hosting, cPanel servers and CloudLinux
✅ Live on my own servers: one already patched this morning, one still waiting on CloudLinux
✅ The stopgap setting to use if you can't patch yet, and why it's only partial
✅ Sites still on PHP 7.4, 8.0 or 8.1: why they'll never be fixed, and moving them to 8.3
✅ What I told my hosting clients today
✅ Your questions in chat
🔗 Links:
CVE-2026-109618 advisory: https://github.com/php/php-src/securi...
CVE-2026-109619 advisory: https://github.com/php/php-src/securi...
PHP downloads and release notes: https://www.php.net/
mySites.guru on the PHP critical release: https://mysites.guru/blog/php-critica...
Cybersalt Consulting: https://www.cybersalt.com

00:00:00 - Intro, Sponsor & Critical PHP Security Emergency
00:07:36 - Critical PHP Vulnerabilities & Affected Sites
00:15:13 - Emergency .htaccess Protection & Taking Sites Offline
00:23:31 - PHP Exploits, Legacy Joomla & CloudLinux Updates
00:35:35 - Hosting Infrastructure, Global Outages & Emergency Patching
00:51:23 - MCP4J Updates, OAuth & Joomla Development Tools
01:10:50 - CloudLinux Security Updates, AI & PHP Foundation Investigation
01:41:05 - Global Impact, AI Vulnerability Discovery & Security Failures
01:59:25 - AI-Powered Joomla Migration & CloudLinux Patch Release
02:23:25 - Restoring Sites, Verifying Patches & Final Updates

Summary

1. Introduction & Critical PHP Security Emergency
Introduces a major PHP security incident involving two critical vulnerabilities and explains why Joomla site owners and hosting providers need to respond quickly. The livestream begins with a MySites.Guru sponsorship and background setup issues.

2. Identifying Vulnerable Websites with MySites.Guru
Uses MySites.Guru to identify client websites missing the security patch, finding that 52 out of 251 sites were initially unpatched. The discussion highlights delays from CloudLinux and the challenge of managing PHP security across many hosted websites.

3. Understanding the PHP Vulnerabilities & Emergency Protection
Explains the two vulnerabilities: one involving out-of-memory request corruption and another involving use-after-free behavior. Demonstrates using .htaccess rules to temporarily block access to affected websites while waiting for a permanent fix.

4. Legacy PHP Versions & Hosting Provider Challenges
Examines the risks for Joomla 3 websites running PHP 7.4, where support and patch availability are concerns. Explains CloudLinux's alternative PHP versions, PHP Selector, CageFS, and differences between managed hosting and full-server administration.

5. Server Patching & Widespread Website Outages
Follows the evolving response as websites, including Joomla-related services, go offline during the crisis. A PHP update becomes available through Liquid Web, and the presenter demonstrates running server update commands while consulting Claude about compatibility with another CloudLinux server.

6. Joomla Tools, MCP4J & AI-Assisted Management
Previews the Cybersalt Extension Manager, discusses the MCP4J 2.9.4 release with OAuth support, and reviews its redesigned dashboard. MySites.Guru is used to update MCP4J across managed websites while the presenter continues monitoring the delayed CloudLinux security release.

7. Investigating the Vulnerability Disclosure & PHP Foundation Response
Reviews the PHP Foundation's post-mortem, tracing how the out-of-memory vulnerability was discovered and why its fix was delayed. Discusses security research involving AI tools, the premature disclosure of vulnerability details, failures in the release process, and proposed improvements to PHP's security ecosystem.

8. AI's Growing Role in Joomla Development & Business
Explores AI-assisted development through a demonstration of migrating a Joomla 2.5 website to Joomla 6 in under 30 minutes with Claude. The discussion considers how AI can improve or replace traditional extension development and why service providers may need to charge for value delivered rather than hours worked.

9. CloudLinux Patch Released & Client Websites Restored
CloudLinux finally releases the PHP security fix. The presenter updates the server, confirms that all nine affected PHP versions—including PHP 7.4—are patched, restores client websites, reconnects them through MySites.Guru, and verifies system information. The livestream also examines why the displayed PHP version number may remain unchanged after an in-place security patch.

10. Final Verification, Follow-Up Updates & Lessons Learned
Uses Claude to help tag server-managed sites in MySites.Guru and contacts support about reporting the patch build date. The presenter warns that a MariaDB update may require another maintenance window, confirms that client sites have been restored and clients notified, and closes with reflections on the scale of the incident and the importance of rapid security response.

Interesting blog? Like it on Facebook, Post it or share this article on other bookmarking websites.