PHP2Shell: the patch is easy. Knowing where to apply it isn't.

On 21 October the PHP project shipped emergency releases for two critical flaws, CVE-2026-109618 and CVE-2026-109619, together nicknamed PHP2Shell. Both allow unauthenticated remote code execution and carry a CVSS v4.0 score of 9.2. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Exploit attempts have been reported by several security vendors and hosting providers. Reports differ on how many succeeded.

If you run PHP, the advice is simple: update. But for a mid-size IT team, the first question this week was not "how do we patch?" It was "where is PHP running?"

The question nobody can answer fast

• Which of our domains are served by PHP, and from which server?
• Which of those servers did someone set up years ago and then leave?
• Which domains are still registered and paid for, but point nowhere we know about?
• Who can log in and fix it, and are they reachable today?

Usually the answer lives in a spreadsheet, a Slack thread, three registrar tabs, and one person's head. During an incident that is the slowest possible place to look.

What knoxed.ai does about it

knoxed.ai is a memory layer, not a security scanner. We want to be precise about that. Here is what is built today:

• A host inventory. A small shell agent on each server sends a heartbeat, so you have one list of the machines you actually run and whether they are alive right now. It also records the version of the php command-line binary where one is installed. That is a hint, not proof: php-fpm or an Apache module on the same host can run a different build, so verify the web-facing version too.
• An event stream. Telemetry from those hosts is kept in an append-only log, so you can see what changed and when.
• A work board. The patch tasks, owners and comments live next to the hosts they relate to, with an audit log.
• Isolation per organization. Your data is separated by row-level security, and ingest keys are hashed.

In progress, and not yet live: the Cloudflare integration and gap report that list every domain you own and flag the ones with no infrastructure behind them, plus a rules-based alerts engine.

What it does not do

knoxed.ai does not detect intrusions, scan for vulnerabilities, or apply patches. Today the agent reports heartbeat, disk, load and the PHP command-line version only, and the dashboard does not yet flag vulnerable versions for you. Use your security tooling and your hosting provider for detection and remediation. We help with the part that comes before it: knowing what you have, where it is, and who owns it.

A practical checklist for this week

1. List every server and domain. Include the ones nobody mentions.
2. Check each server's PHP version against the fixed releases above.
3. Update, or ask the hosting provider to update. Where you cannot, follow your vendor's and national guidance on isolating the system.
4. Review web server and application logs for unusual requests since 17 October.
5. Write down what you found, and where, so the next incident starts from a record rather than from memory.

Step one is where teams lose the most time. That is the problem we are building for. Join the design-partner beta, free while we build.

Sources: PHP project release announcements; reporting from Rapid7, Help Net Security, The Hacker News and Patchstack, 21–23 October 2026. Details are still developing.