[{"data":1,"prerenderedAt":330},["ShallowReactive",2],{"{\"cv\":1792768603830,\"version\":\"published\"}widgets\u002Fnavigation-bar":3,"{\"cv\":1792768603830,\"resolve_relations\":[\"ResourceFeatureCard.resource\"],\"version\":\"published\"}\u002Fblog\u002Fphp2shell-mitigation-cut-off-the-attacker-s-path-while-you-patch":67},{"data":4,"headers":45},{"story":5,"cv":42,"rels":43,"links":44},{"name":6,"created_at":7,"published_at":8,"updated_at":9,"id":10,"uuid":11,"content":12,"slug":32,"full_slug":33,"sort_by_date":22,"position":34,"tag_list":35,"is_startpage":15,"parent_id":36,"meta_data":22,"group_id":37,"first_published_at":38,"release_id":22,"lang":39,"path":40,"alternates":41,"default_full_slug":22,"translated_slugs":22},"Navigation Bar","2026-08-05T05:55:49.585Z","2026-08-07T15:41:09.255Z","2026-08-07T15:41:09.269Z",205700094329908,"be34732b-2155-45e7-8ee2-86e1157a8cb4",{"_uid":13,"component":14,"showMarketingBanner":15,"marketingBannerContent":16},"e7a8d72d-8af8-452e-87b2-de4098162fb9","NavigationBar",false,{"type":17,"content":18},"doc",[19],{"type":20,"attrs":21,"content":23},"paragraph",{"textAlign":22},null,[24],{"text":25,"type":26,"marks":27},"See us at Black Hat booth #7505","text",[28],{"type":29,"attrs":30},"textStyle",{"color":31},"#000000","navigation-bar","widgets\u002Fnavigation-bar",0,[],205696803161001,"e116d2fb-7cac-4697-9dcb-91d9283aecc3","2026-08-05T06:19:33.200Z","default","\u002F",[],1792768484,[],[],{"cache-control":46,"connection":47,"content-length":48,"content-type":49,"date":50,"etag":51,"referrer-policy":52,"sb-be-version":53,"server":54,"strict-transport-security":55,"vary":56,"via":57,"x-amz-cf-id":58,"x-amz-cf-pop":59,"x-cache":60,"x-content-type-options":61,"x-frame-options":62,"x-permitted-cross-domain-policies":63,"x-request-id":64,"x-runtime":65,"x-xss-protection":66},"max-age=0, public, s-maxage=604800, stale-if-error=3600","keep-alive","986","application\u002Fjson; charset=utf-8","Fri, 23 Oct 2026 15:17:13 GMT","W\u002F\"6d57c9b1a0bb384f5c66420fd5ba3c75\"","strict-origin-when-cross-origin","5.993.0","nginx\u002F1.31.3","max-age=31536000","Origin","1.1 f62865a6aba38ebc6bc6283096c5ae5c.cloudfront.net (CloudFront)","e3qtzlxf4n5l8aAe7mBofkBn3m5qmTGN0iil9AC1ugV0JfHxGb393Q==","CMH68-P4","Miss from cloudfront","nosniff","SAMEORIGIN","none","117e94fd-e68e-49ef-b608-175ed24105d0","0.014298","0",{"data":68,"headers":320},{"story":69,"cv":42,"rels":318,"links":319},{"name":70,"created_at":71,"published_at":72,"updated_at":73,"id":74,"uuid":75,"content":76,"slug":310,"full_slug":311,"sort_by_date":312,"position":313,"tag_list":314,"is_startpage":15,"parent_id":315,"meta_data":22,"group_id":316,"first_published_at":72,"release_id":22,"lang":39,"path":22,"alternates":317,"default_full_slug":22,"translated_slugs":22},"PHP2Shell Mitigation: Cut Off the Attacker’s Path While You Patch ","2026-10-23T15:02:56.830Z","2026-10-23T15:12:02.694Z","2026-10-23T15:12:02.713Z",233792212318229,"46a097e7-c690-449a-8696-6efa16188efc",{"Tags":77,"_uid":78,"body":79,"title":80,"content":81,"component":250,"seoOgImage":251,"keyTakeaways":257,"previewImage":304,"previewTitle":306,"relatedContent":307,"seoDescription":308,"previewDescription":309},"","69a52ed9-008b-4441-a3c4-57b32d15254b",[],"PHP2Shell mitigation: Cut off the attacker’s path while you patch",{"type":17,"attrs":82,"content":83},{"backgroundColor":22},[84,92,100,108,121,129,137,146,154,162,170,178,187,195,203,212,220,228,237,245],{"type":20,"attrs":85,"content":86},{"textAlign":22},[87],{"text":88,"type":26,"marks":89},"Some vulnerabilities politely wait for your next maintenance window. PHP2Shell did not.",[90],{"type":29,"attrs":91},{"color":31},{"type":20,"attrs":93,"content":94},{"textAlign":22},[95],{"text":96,"type":26,"marks":97},"CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution in the PHP runtime itself, across nearly every version back to 5.4. Both carry a CVSS v4.0 score of 9.2. Details leaked before coordinated disclosure, PHP shipped emergency fixes on October 21, and researchers logged exploitation attempts against honeypots that same day.",[98],{"type":29,"attrs":99},{"color":31},{"type":20,"attrs":101,"content":102},{"textAlign":22},[103],{"text":104,"type":26,"marks":105},"Organizations are scrambling to update or disconnect vulnerable applications.",[106],{"type":29,"attrs":107},{"color":31},{"type":109,"attrs":110,"content":112},"heading",{"level":111,"textAlign":22},2,[113],{"text":114,"type":26,"marks":115},"Patching is the fix. Everything else buys time.",[116,119],{"type":29,"attrs":117},{"color":118},"#F68D2E",{"type":120},"bold",{"type":20,"attrs":122,"content":123},{"textAlign":22},[124],{"text":125,"type":26,"marks":126},"The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get official releases, though PHP published source backports for 7.4 through 8.1. Interim configuration changes, such as disabling session upload progress, close known attack paths but not every path. PHP’s own guidance is that no setting fully mitigates the flaws.",[127],{"type":29,"attrs":128},{"color":31},{"type":20,"attrs":130,"content":131},{"textAlign":22},[132],{"text":133,"type":26,"marks":134},"That leaves teams with an uncomfortable choice: rush an untested update into production, or take the application offline until the update is ready. Several organizations chose the second option as a precaution, pulling services people rely on every day.",[135],{"type":29,"attrs":136},{"color":31},{"type":109,"attrs":138,"content":139},{"level":111,"textAlign":22},[140],{"text":141,"type":26,"marks":142},"An unreachable application is the strongest interim defense",[143,145],{"type":29,"attrs":144},{"color":118},{"type":120},{"type":20,"attrs":147,"content":148},{"textAlign":22},[149],{"text":150,"type":26,"marks":151},"The most common advice for systems that can’t be updated immediately is to restrict their internet access. An exploit request that never arrives can’t execute.",[152],{"type":29,"attrs":153},{"color":31},{"type":20,"attrs":155,"content":156},{"textAlign":22},[157],{"text":158,"type":26,"marks":159},"For internal applications accessed exclusively through Xiid Terniion the exposure picture is fundamentally different.",[160],{"type":29,"attrs":161},{"color":31},{"type":20,"attrs":163,"content":164},{"textAlign":22},[165],{"text":166,"type":26,"marks":167},"Terniion enables client\u002Fserver communication without opening inbound ports on either endpoint’s firewall. Employees can access their CRM, IT management console, or internal knowledge base through authorized, one-to-one, process-to-process connections while the underlying service remains unreachable to unauthorized network traffic.",[168],{"type":29,"attrs":169},{"color":31},{"type":20,"attrs":171,"content":172},{"textAlign":22},[173],{"text":174,"type":26,"marks":175},"Those connections receive three layers of protection, combining hybrid post-quantum key establishment with end-to-end AES-256-GCM authenticated encryption (AEAD). Intermediaries cannot decrypt the application traffic.",[176],{"type":29,"attrs":177},{"color":31},{"type":109,"attrs":179,"content":180},{"level":111,"textAlign":22},[181],{"text":182,"type":26,"marks":183},"Room to patch properly instead of patching in a panic",[184,186],{"type":29,"attrs":185},{"color":118},{"type":120},{"type":20,"attrs":188,"content":189},{"textAlign":22},[190],{"text":191,"type":26,"marks":192},"For PHP2Shell, the decisive protection is removing the attacker’s path to PHP. Customers with exclusively Terniion-protected applications can validate and deploy updates on a sensible timeline while authorized users keep working. Nobody has to choose between operational continuity and emergency isolation.",[193],{"type":29,"attrs":194},{"color":31},{"type":20,"attrs":196,"content":197},{"textAlign":22},[198],{"text":199,"type":26,"marks":200},"It reduces the pressure to choose between operational continuity and emergency isolation.",[201],{"type":29,"attrs":202},{"color":31},{"type":109,"attrs":204,"content":205},{"level":111,"textAlign":22},[206],{"text":207,"type":26,"marks":208},"Where Terniion’s protection stops",[209,211],{"type":29,"attrs":210},{"color":118},{"type":120},{"type":20,"attrs":213,"content":214},{"textAlign":22},[215],{"text":216,"type":26,"marks":217},"Updates still matter because Terniion does not repair vulnerable PHP. An authorized and compromised endpoint remains a potential source of malicious requests. Plan your updates accordingly.",[218],{"type":29,"attrs":219},{"color":31},{"type":20,"attrs":221,"content":222},{"textAlign":22},[223],{"text":224,"type":26,"marks":225},"But the architectural benefit is clear: your maintenance schedule becomes less dependent on how quickly strangers on the Internet can weaponize the next vulnerability.",[226],{"type":29,"attrs":227},{"color":31},{"type":109,"attrs":229,"content":230},{"level":111,"textAlign":22},[231],{"text":232,"type":26,"marks":233},"Vulnerabilities are inevitable. Open paths to them are optional.",[234,236],{"type":29,"attrs":235},{"color":118},{"type":120},{"type":20,"attrs":238,"content":239},{"textAlign":22},[240],{"text":241,"type":26,"marks":242},"Software will always have flaws, and the next PHP2Shell is already sitting in someone’s codebase. Keeping internal applications reachable only by the processes authorized to use them makes those flaws much harder for outsiders to exploit. Your maintenance schedule stops depending on how quickly strangers on the internet can weaponize the next one.",[243],{"type":29,"attrs":244},{"color":31},{"type":20,"attrs":246,"content":247},{"textAlign":22},[248],{"type":249},"hard_break","BlogPost",{"id":252,"alt":77,"name":77,"focus":77,"title":77,"source":77,"filename":253,"copyright":77,"fieldtype":254,"meta_data":255,"is_external_url":15},233794141130245,"https:\u002F\u002Fa.storyblok.com\u002Ff\u002F292462593318313\u002F4896x2754\u002Fc795da21db\u002Fdata-center-computer-systems-controlling-network-resources-closeup-1.jpg","asset",{"size":256},"4896x2754",{"type":17,"attrs":258,"content":259},{"backgroundColor":22},[260],{"type":261,"content":262},"bullet_list",[263,274,284,294],{"type":264,"content":265},"list_item",[266],{"type":20,"attrs":267,"content":268},{"textAlign":22},[269],{"text":270,"type":26,"marks":271},"PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets unauthenticated attackers run code on servers running nearly any PHP version back to 5.4, and exploitation attempts started within a day of disclosure.",[272],{"type":29,"attrs":273},{"color":31},{"type":264,"content":275},[276],{"type":20,"attrs":277,"content":278},{"textAlign":22},[279],{"text":280,"type":26,"marks":281},"Patching is the only complete fix. PHP says no configuration change fully mitigates either flaw.",[282],{"type":29,"attrs":283},{"color":31},{"type":264,"content":285},[286],{"type":20,"attrs":287,"content":288},{"textAlign":22},[289],{"text":290,"type":26,"marks":291},"For systems that can’t be updated right away, the standard interim advice is to restrict their internet access.",[292],{"type":29,"attrs":293},{"color":31},{"type":264,"content":295},[296],{"type":20,"attrs":297,"content":298},{"textAlign":22},[299],{"text":300,"type":26,"marks":301},"Internal apps reached only through Xiid Terniion already meet that bar, so teams can test and deploy fixes without pulling services offline.",[302],{"type":29,"attrs":303},{"color":31},{"id":252,"alt":77,"name":77,"focus":77,"title":77,"source":77,"filename":253,"copyright":77,"fieldtype":254,"meta_data":305,"is_external_url":15},{"size":256},"Can’t patch PHP2Shell today? Remove the path to PHP",[],"PHP2Shell is under active exploitation. See why unreachable internal apps give you time to patch CVE-2026-109618 and CVE-2026-109619 safely.","Patching is the only complete fix for PHP2Shell. Here’s how internal apps behind Terniion stay out of attackers’ reach while you test and deploy it.","php2shell-mitigation-cut-off-the-attacker-s-path-while-you-patch","blog\u002Fphp2shell-mitigation-cut-off-the-attacker-s-path-while-you-patch","2026-05-15",30,[],193139877037850,"f765b4de-e24f-4c22-80b5-a7ec5e0638fe",[],[],[],{"cache-control":46,"connection":47,"content-encoding":321,"content-type":49,"date":322,"etag":323,"referrer-policy":52,"sb-be-version":53,"server":54,"strict-transport-security":55,"transfer-encoding":324,"vary":325,"via":326,"x-amz-cf-id":327,"x-amz-cf-pop":59,"x-cache":60,"x-content-type-options":61,"x-frame-options":62,"x-permitted-cross-domain-policies":63,"x-request-id":328,"x-runtime":329,"x-xss-protection":66},"gzip","Fri, 23 Oct 2026 15:17:16 GMT","W\u002F\"0f31ff78a90249840b9c48aa246747f4\"","chunked","Origin,Accept-Encoding","1.1 a37c6915c3c7316887c2daf616d0206c.cloudfront.net (CloudFront)","8EGMAKWY32svZwSKrxYRoHISErZjzWTZ8qeJENnlfVwSZZ8zhd7rwg==","cfedf1c2-1b91-4e20-8f7f-2b4a24a510ae","0.021014",1792768636075]