On 20 October the first reports appeared of two critical flaws in PHP (CVE-2026-109618 and CVE-2026-109619, now known as PHP2Shell). PHP runs a large share of the web, and two days later attacks in the wild were reported. This is how Pro CISO handled it for its customers.
Early warning. We flagged the coming critical release at 22:08 on 20 October, 24 minutes before PHP's own announcement.
Inside-out. While no patch existed, the ReconX agent monitored our customers' internal hosts for anomalies.
Outside-in, the attacker's view. On 21 October at 12:40, each affected customer received the exact list of its servers running PHP, with a ticket to act on.
Instructions as soon as the fix was out. That afternoon, every affected customer received what to install for each PHP branch, and the temporary measures to apply until then.
Continuous status. From the morning of 22 October our scans confirmed, server by server, which systems were patched and which were still vulnerable. Customers have been kept updated as systems move from one to the other.
Verified, then shared. On 23 October every listed system was re-verified live. On 24 October we published the full timeline on ReconX Watchtower, open to everyone.
The first attacks were reported 26 hours after our customers knew exactly which servers to update.
The notice: watchtower.prociso.com/php-remote-code-execution-php2shell
#cybersecurity #vulnerabilitymanagement #PHP #attacksurfacemanagement #ProCISO
