A security alert can affect more than a website. It can put business information and service continuity at risk. That is why timely updates, coordination with hosting providers, and verification are essential parts of our website and application maintenance.
On October 20, 2026, details of two critical PHP vulnerabilities, known as PHP2Shell, were disclosed ahead of schedule. PHP powers websites and applications worldwide, including projects built with WordPress, Drupal, and Laravel. We prioritized the alert and began reviewing the environments under our responsibility.
What happened, and why did it require immediate attention?
The vulnerabilities affected PHP itself and could allow remote code execution under certain conditions. Exposure depended on the PHP version and server configuration. Using WordPress, Drupal, or Laravel did not mean every project faced the same level of risk.
The PHP team published its official advisories on October 21: remote code execution through out-of-memory corruption (CVE-2026-109618) and remote code execution through stale global state (CVE-2026-109619). The patched releases were PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
Because details had circulated before patches were available, reducing the window of exposure was particularly important. Updating a CMS or its plugins alone would not replace patching the underlying PHP runtime.
PHP2Shell affects the PHP runtime. Updating the CMS alone does not replace applying the appropriate PHP security patch.
Our response timeline
- October 21: we began inventorying projects, PHP versions, and hosting providers to identify affected environments and establish who would apply each fix. As corrected packages became available that day, we applied patches to infrastructure we manage and verified the first Pantheon updates.
- October 21–22: we tracked provider rollouts and checked corrected PHP versions across the environments reviewed. We prioritized internet-facing services and followed up on development and testing environments.
Verification matters: installing an updated package does not necessarily mean the processes serving a website are running the corrected version. Our response included checking the PHP versions actually in use.
Our response combines detection, prioritization, patching, and verification, supported by temporary mitigations and ongoing monitoring.
How we worked with Pantheon and other hosting environments
Pantheon-hosted websites
Pantheon applied security patches to its platform. Swapps tracked the rollout and verified corrected PHP versions on the sites reviewed. Updates were distributed progressively, so production, development, and testing environments did not all receive them at the same time. We continued following up as the rollout progressed.
According to Pantheon’s official incident report, all live production sites running PHP versions supported by the PHP community were patched by October 21 at 19:49 UTC. Pantheon closed the incident on October 22 following overnight monitoring. Swapps separately tracked and verified the environments under our responsibility.
Infrastructure managed by Swapps
On infrastructure under our administration, we applied the relevant security packages directly and checked operation afterward. Some environments received fixes through operating-system packages. These packages can include the security correction without displaying the same version number as an upstream PHP release, making verification of the provider’s security update important.
Other hosting providers
For environments using WP Engine and cPanel, we followed patch availability and installation and verified the relevant updates. Hosting providers and our team play complementary roles: providers maintain their platforms, while Swapps follows through on the update for the project.
Environments running older PHP branches that require migration need individual compatibility review and testing. Temporary protective measures must be accompanied by a plan to address the underlying issue.
Pantheon’s explanation of its layered security response distinguishes runtime patching from temporary mitigations and deployment controls. These protections serve different purposes; applying a patch does not, by itself, investigate or remediate a previous compromise.
Proactive attention beyond PHP
During the same period, vulnerabilities were also reported in other technologies. We are proactively assessing their relevance to the projects we maintain and addressing applicable fixes according to risk and exposure.
This means looking across the website or application, its libraries, supporting services, and underlying systems. Keeping a CMS up to date is one part of a broader maintenance process.
Stronger maintenance, supported by AI
Over the past two months, we have strengthened our maintenance process. We receive alerts directly from security sources for the technologies we use, helping us assess their impact and apply fixes as quickly as possible.
We also use our AI-powered Swapps platform to review websites, libraries, and systems weekly and identify potential vulnerabilities. These reviews complement urgent alerts: a critical vulnerability requires attention when it becomes known, without waiting for the next weekly review.
We are actively incorporating AI into our work to respond faster, expand our review capacity, and strengthen security. It also helps us dedicate more capacity to improvements that deliver value and business impact for our clients. These tools complement our technical team’s analysis, validation, and judgment.
Learn more about how AI-augmented website maintenance combines automation with technical oversight.
Protecting information and business continuity
Security is our highest maintenance priority. Our goal is to reduce risk, protect data, and keep the websites and applications our clients depend on stable.
Our PHP2Shell response illustrates why active maintenance requires timely alerts, knowledge of each environment, coordination with hosting providers, and verification after changes. We apply that approach to urgent security issues and ongoing prevention alike.
Need to review the security and maintenance of your website or application? Talk to the Swapps team about your environment and the priorities that matter to your business.
For Drupal-based projects, explore our Drupal maintenance and development support, or talk to our team about the needs of your existing environment.