PHP vulnerability: managing a critical risk while waiting for a patch

On 21 October 2026, the PHP project disclosed CVE-2026-109618 and CVE-2026-109619, also known as PHP2Shell. The vulnerabilities let an unauthenticated attacker execute code on PHP systems that serve web requests. Fixed versions are out (8.5.12, 8.4.27, 8.3.36 and 8.2.35), and PHP advises that updating is the only complete mitigation. 

For an organisation running its own PHP, that’s a change ticket. For an organisation running PHP inside someone else’s software, it’s a waiting game. The vulnerability discovery highlights a key risk that will continue to loom over technology environments long after the last patch is complete. 

What the PHP vulnerability showed us 

Most organisations don’t choose their PHP version. Instead, it arrives inside a platform they deploy: a content management system, plugin, business application or a supplier’s hosted service. The risk comes with the product, and the dependency list sits with the vendor. 

That’s a textbook example of third-party risk materialising. The first step in any incident like this is working out which of your systems are affected. Vendor-managed applications are the ones most likely to be missed. 

The gap between discovery and remediation, and the controls that fill it 

When the vulnerable code sits in a third-party application, the remediation process happens in this order. 

• The vendor assesses whether the product is affected. 

• The vendor builds, tests and releases an updated package. 

• You test it against your own environment. 

• You get change approval and book a window. 

The gap between discovery and remediation, and the controls that fill it 

When the vulnerable code sits in a third-party application, the remediation process happens in this order. 

• The vendor assesses whether the product is affected. 

• The vendor builds, tests and releases an updated package. 

• You test it against your own environment. 

• You get change approval and book a window. 

Every step is reasonable. But together, they leave a gap between disclosure and remediation where the flaw is public and your system’s reachable. This gap is unavoidable. What you still control is how much an attacker can reach during it. In a justifiable abundance of caution, the PHP vulnerability has led organisations to take critical systems offline. 

Compensating controls like this are what reduces risk in the interim. When deciding to apply one, answer the following questions about impacted systems. 

• Who can reach the vulnerable system from outside? 

• If it were compromised, what could it reach next? 

You don’t control when a software vendor makes a permanent fix available. What you can control is how exposed the affected system remains while you wait.  

Doing that effectively requires the right people to understand the risk, established processes to coordinate the response, and technical controls that can be applied quickly and safely.

How Interactive helps customers respond 

At Interactive, we see cyber resilience as the combination of three things: people, processes and technology. Together, they create a coordinated capability that enables our customers to anticipate, detect, respond to, recover from and learn from cyber threats. 

People: expertise ready when you need it 

Addressing a critical vulnerability is a cross-functional exercise. Responding to security events requires cyber security analysts, infrastructure engineers, network specialists, application owners, incident responders, service managers and technology providers working together. Crucially, these functions need to come and work together quickly. 

Finding those skills during an incident is difficult. Coordinating them can be even harder. That’s where Interactive plays an important role. We bring together the specialists required to understand the issue, make informed decisions and coordinate the response.  

Interactive’s managed infrastructure capabilities are complemented by the specialist cyber capabilities of Slipstream Cyber, including security operations, Managed Detection and Response, threat hunting, vulnerability management, Digital Forensics and Incident Response, cyber consulting and technical assurance.  

The advantage isn’t simply access to specialist skills. It’s having those capabilities already connected through an established service relationship, rather than having to assemble the response after a critical incident has begun. 

Process: resilience starts before the incident  

Technology alone doesn’t create cyber resilience. Roles, escalation paths, decision rights and communications must be established before a critical advisory arrives. 

Interactive’s service management practices provide the operational discipline behind the technical response. Our Major Incident Management process is informed by ITIL 4 and brings incident, change, configuration and problem management together. This helps teams coordinate technical action with business impact, risk acceptance, governance and customer communication. 

This means we can act quickly in the event of an incident – while maintaining the control, evidence and accountability of our standard operating procedures. 

Technology: platform controls that reduce exposure 

For our Interactive Private Cloud customers, the platform’s native security features provided stability amid the uncertainty. 

Its security controls allow organisations to: 

• See the entire environment in one place – Centralised observability brings relevant infrastructure health, events, alerts and operational telemetry together, giving teams greater situational awareness during both normal operations and a security event.  

• Reduce external exposure – Gateway Firewall sits at the edge of the customer environment. It controls what traffic is allowed in and out. During an event like this, we review active rules with the customer, remove inbound and outbound access that isn’t needed and record the change.  

• Limit lateral movement – Distributed firewalls, security groups and micro-segmentation can constrain communication between workloads, reducing the accessible environment if a system is compromised. 

• Detect and respond to suspicious activity – Intrusion detection and prevention capabilities can provide an additional defensive layer where relevant detection and enforcement policies are available and appropriately configured. 

• Maintain the underlying platform – Controlled lifecycle management helps Interactive introduce eligible infrastructure security updates quickly while minimising disruption to services running on the platform. 

• Prepare to recover – Prevention and containment remain the priority, but resilient environments also plan for recovery. Backup and disaster recovery provide recovery options for appropriately protected systems when an incident causes data loss, corruption or service disruption. 

Lessons for the future  

The PHP vulnerability served as a wake-up call to many Australian technology environments. The controls built into Interactive Private Cloud give our customers ways to reduce exposure while a fix is on its way. 

Of course, these controls have limits. None of them detect exploitation on their own or guarantee containment, and how well they work depends on the rules configured and how well the application’s traffic flows are understood. 

No platform makes an organisation immune to a flaw in a supplier’s software. But regardless of platform, managing critical vulnerabilities under time pressure, while staying as close to BAU as possible, is easier with the right team behind you. 

For our customers, that’s what we’re here for. When the advisory came through, we ran the response on behalf of our customers, from assessment and change coordination through to validation. We identified the advisory early and tracked its impact across the vendors that support our customers. That response was consistent across our customer base, whether they run on Interactive Private Cloud, public cloud, an on-premises environment or a combination of these. Key to our response has been collaboration across our specialist teams, including vendor-certified engineers, cloud specialists and our cyber security arm providing timely, critical advice on the best way forward.   

Collaboration is key to an effective response in security events like these. No matter how our customers are impacted, they have one accountable partner they can trust to keep their technology environment secure and unstoppable.