Incident History

As of now, October 22 at 04:00 CEST all systems have been upgraded to the latest PHP versions, configurations have been tweaked and monitoring has been enabled.

What we did

• Patched: we updated every PHP server we manage to the fixed versions (PHP 8.4.27 and 8.5.12).
• Checked: on each system we reviewed authentication, web server and PHP logs, user accounts, file checksums and running processes. We found no evidence that these vulnerabilities were exploited on our systems.
• Hardened: we applied the PHP project's recommended configuration changes, including disabling session upload progress.
• Monitored: all systems run file-integrity monitoring and a restricted firewall.

What we're doing next

We're extending web application firewall protection and monitoring to more systems, and we'll keep reviewing logs in the coming days.

Read more about it on our blog:

This morning we were made aware of critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619), also known as "PHP2shell".

No patches are available for the moment, but the PHP core team announced that updates will be made available at 16:00 CEST (see https://www.php.net/archive/2026.php#2026-10-20-1). We will monitor this situation closely and will apply updates to our systems the moment they're available.

We have WAF in front of our client's web apps and we monitor activity closely for signs of malicious intent.

When new information is available, we'll update you through this channel. If you have questions, please contact us at support@in2it.be.