PHP2Shell & Co.: The Week Security Stopped Being Optional for Small SaaS

Between October 20 and 21, 2026, two critical PHP vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) were leaked, patched and already exploited. The same day, the popular AI package LiteLLM shipped with a credential stealer inside, and GitLab had to fix a flaw with the maximum score of 10.0.

For large companies with a security team, it was a rough week. For a small SaaS without a dedicated security team, it's a wake-up call: the gap between "vulnerability disclosed" and "vulnerability exploited" is now measured in hours, not weeks.

01What is PHP2Shell? Leaked before the patch existed

On October 20, a post on Hacker News announced two critical PHP vulnerabilities. It was taken down, but screenshots were already circulating, and watchTowr confirmed the flaws were real (Huntress).

The PHP team pulled its planned release forward. On October 21, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 shipped (PHP security advisory) – and the same day, watchTowr's honeypots recorded the first attacks in the wild (watchTowr).

What makes the two flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2 each) so dangerous:

• No login required. Both allow remote code execution without authentication – a crafted request is enough.
• Almost every install. According to watchTowr, every PHP version since PHP 5 is affected, meaning code dating back to 2004. PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed alike.
• With mod_php, before your code runs. On Apache mod_php, the attack can fire before a single line of your application executes.
• Secrets in memory. Wiz demonstrated an additional path to read PHP worker memory – including passwords, tokens, API keys and certificates (Huntress).

The US agency CISA urges organizations to patch immediately. PHP 8.1 and older no longer get official updates from the PHP project.

And if you're thinking "We don't even use PHP": your WordPress marketing site, your host's control panel or an off-the-shelf Docker image often run on it. PHP tends to hide exactly where nobody looks.

02Not just PHP2Shell: LiteLLM, GitLab and PwnEscape

PHP2Shell was the loudest headline, but not the only one. In the last eight days alone, several more critical findings landed:

For AI SaaS, LiteLLM is the real wake-up call. The package routes requests across dozens of LLM providers and stores their API keys. According to LiteLLM's own incident report, attackers used apparently stolen GitHub tokens of three developers to push a release containing a credential stealer and remote-code-execution tooling.

You're affected if you installed litellm==1.107.0 from PyPI on October 21 between 11:39 and 13:23 UTC, or ran the Docker image (v1.107.0, latest, main-latest or main-stable) between 11:46 and 14:20 UTC. The packages have been pulled, but stolen data stays stolen.

03Why critical vulnerabilities are surfacing faster

These flaws have little in common – and yet they tell the same story. Four things stand out.

Old code, new eyes. The OpenBSD bug dates from 1988, the PwnEscape code goes back to Linux 2.6.27, and GitLab is affected back to version 7.0 from 2014. Bugs nobody found for years are now being found in batches.

AI is speeding up the hunt. According to pwn.ai, PwnEscape was discovered with AI assistance (Let's Data Science). For PHP2Shell, researchers at Calif revisited earlier findings as part of OpenAI's "Patch the Planet" initiative (Huntress). What helps defenders helps attackers just as much.

The window is gone. Leak on October 20, patch on the 21st, first attacks the same day. "We'll get to it next sprint" is no longer a plan.

Your secrets are the target. With PHP2Shell, worker memory can expose API keys; with LiteLLM, API keys were harvested on purpose. Whoever has your keys has your database, your customer data and your bill at your LLM provider.

04Why SaaS startups without a security team are most at risk

Large companies have someone who reads advisories and patches at 2 a.m. A three-person founding team has features, support and sales – and security happens "on the side."

• Built fast means lots of other people's code. Frameworks, packages, Docker images on the latest tag, often AI-generated code. Every dependency is code you answer for to your customers.
• Being small doesn't protect you. After a disclosure, attackers scan specifically for servers that haven't been updated yet (SiteGround). The scanners don't ask about your MRR.
• A traditional pentest doesn't fit. It easily runs into four or five figures and takes weeks. And it's a snapshot that's out of date after your next deploy.

The result: many small SaaS companies simply don't know what they expose to the outside world. That's exactly the gap attackers exploit.

05PHP2Shell checklist: what to do today

The good news: most of this takes hours, not weeks. In this order:

1. Find and patch PHP. Go through every server, container and hosting plan, including the WordPress site. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart PHP processes and rebuild your Docker images.
2. Take old PHP off the internet. If anything runs PHP 8.1 or older, no official fix is coming. Upgrade, or put it behind a web application firewall or VPN until you can.
3. Rotate your secrets. Because the flaws can leak worker memory, replace passwords, API keys and tokens on internet-facing PHP systems (Huntress).
4. Check LiteLLM. If you installed version 1.107.0 or ran an affected Docker image during the window, treat that environment as compromised. Don't run pip in it: remove the malicious files, rebuild from scratch, pin litellm==1.106.2 and rotate every key the host could reach – especially the provider keys in the LiteLLM database (LiteLLM).
5. Update GitLab if you host it yourself. GitLab.com is already patched.
6. Pin your versions. No latest in production; pin dependencies and update deliberately.
7. Look from the outside. Patches close known holes in your stack. The bugs in your own app – a key in your JavaScript bundle, an exposed admin endpoint – you'll only find with an external pentest that looks at your app the way an attacker does.

06Affordable pentesting for SaaS without a security team

Polaris1 is an affordable external pentest for small SaaS teams without their own security team. You enter a domain – no install, no code access, no credentials. It tests from the outside, the way a stranger sees your app (how it works).

• Only your own systems. You prove you own the domain with a DNS TXT record; two independent resolvers have to agree.
• You stay in control. You watch the test live, decide how hard it pushes your production system, and can stop it at any time.
• Only proven findings. Every finding is reproduced with different parameters before it reaches your report – with its location, the proof and a concrete fix.
• Read-only and in the EU. Polaris1 never writes to your code, never holds credentials, and keeps data in the EU, GDPR-compliant.

The pricing fits in one sentence: If Polaris1 finds nothing critical or high, you pay nothing. If something serious is proven, the test costs €199, and the retest after your fix is free for 14 days (pricing).

A traditional pentest has its place, for enterprise customers or audits, for example. And Polaris1 doesn't replace a PHP update. But it shows you what's still open after the update – on the day you ship, not six weeks later.

This week made one thing clear: vulnerabilities don't wait until you have time. Find your leaks before someone else does.

FAQPHP2Shell FAQ

Am I affected by PHP2Shell?

If you run PHP to serve web requests and haven't updated since October 21, 2026, assume yes. PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are all affected (PHP security advisory).

Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no official updates; for people building from source, the PHP team published minimal backports for 7.4, 8.0 and 8.1.

Is PHP2Shell being exploited?

Yes. watchTowr observed exploitation in the wild on October 21, 2026 – the same day the patches shipped (watchTowr).

Is there a workaround if I can't update right away?

The PHP team lists temporary measures such as session.upload_progress.enabled=0 and memory_limit=-1. It also says clearly that only an update is a complete fix.

How can a small SaaS get a pentest without a security team?

An external pentest like Polaris1 only needs your domain – no agent, no code access, no credentials. The count of findings is always free, and you only pay €199 if a critical or high issue is proven.

Sources

• PHP: Security advisory – Critical remote code execution vulnerabilities
• watchTowr: PHP Remote Code Execution FAQ
• Huntress: Rapid Response – php2shell
• CISA: Critical Vulnerabilities in PHP Require Immediate Patching
• SiteGround: Critical PHP vulnerabilities, October 2026
• LiteLLM: Incident report – release v1.107.0 compromised
• The Hacker News: Critical GitLab Flaw (CVSS 10.0)
• The Hacker News: OpenBSD Root Exploit
• Cybernews: PwnEscape
• Let's Data Science: pwn.ai Finds Linux Kernel VM Escape Flaw

← Back to Blog