![](/sites/default/files/styles/blog_hero_image_mobile/public/media/image/2026-11/php2shell-blog-icon-v2%201.png?itok=opaXRYXp) Image ![John Money](/sites/default/files/styles/post_content_attribution_headshot/public/media/image/2026-11/Blue.png?h=3cd06fc8&itok=NGTm7jm1) [John Money](/about-us/team/john-money) Director, Product Marketing, Platform & Drupal Acquia # PHP2Shell and the New Clock for Patching Published: November 2, 2026 6 minute read [Share this blog post on LinkedIn ](https://www.linkedin.com/sharing/share-offsite/?url=https://www.acquia.com/blog/php2shell-and-new-clock-patching) [Share this blog post on Twitter ]() [Share this blog post via Email ]() Copy Markdown AI found a 14-year-old PHP flaw in weeks. Here is how Acquia patched every Drupal application it hosts the same day, with sites online throughout. ![](/sites/default/files/styles/blog_hero_image_mobile/public/media/image/2026-11/php2shell-blog-icon-v2%201.png?itok=opaXRYXp) For 14 years, a critical flaw sat in PHP, the language behind a large share of the web, including every Drupal application Acquia runs. Years of human review missed it. In August 2026, AI found it twice in less than three weeks. Researchers at Calif, working with OpenAI's GPT-5.6 Sol, [found the first issue](https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/) on 1 August. Wiz found the same flaws independently from 19 August, [using AI models of its own](https://www.wiz.io/blog/php2shell-php-rce). On 21 October, the PHP project released fixes for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two critical vulnerabilities that let an attacker run code on a web server without logging in. When AI can surface a 14-year-old flaw in weeks, the window between disclosure and exploitation shrinks to hours. The only question that matters is whether your platform moves faster than the attackers using the same models. ## AI moved the starting line News of the vulnerabilities [leaked on Hacker News](https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities) on 20 October, which forced PHP to release a day early. Amazon Threat Intelligence had already [logged an exploitation attempt](https://en.wikipedia.org/wiki/PHP2Shell) on 17 October, before public disclosure. Wiz demonstrated unauthenticated remote code execution against stock images of the most popular PHP content management systems. Some of the most security-conscious organizations in the world chose to unplug. Finland, the Netherlands, and France [pulled government websites offline](https://decrypt.co/381567/who-found-php-bug-governments-unplug-websites-chatgpt) on the day of release. The US National Security Agency advised organizations to go offline if they could not update immediately. That is the new baseline. Patch speed is now a board-level security metric, and it is measured in hours. A quarterly maintenance window is a liability. ## Open source made AI a defender first The skeptic's reading of PHP2Shell is that open code gives AI an easy target. The record shows the opposite. The same models that read open code for attackers read it for defenders, and this time the defenders got there first. Calif, OpenAI, Wiz, and the PHP maintainers verified and coordinated a single fix. Hosting providers received advance notice and the patch source under embargo, allowing them to build and test before release day. The wider ecosystem [shipped backports for older PHP versions](https://en.wikipedia.org/wiki/PHP2Shell) within days. With a proprietary stack, you wait on one vendor's priorities and take its word that the fix is complete. Open source turns many eyes into many models. Every researcher, every AI lab, and every maintainer working on PHP made the fix stronger and faster. A fix in a repository protects no one, though. Someone has to put it on every server, in production, while the leak is live. That is where the real gap opened on 21 October. ## How Acquia streamlined security for our customers on 21 October Acquia received advance notice under embargo on 19 October, and opened its formal security incident process that day. By 00:21 UTC on 21 October, Acquia had built and tested its own patched PHP for every supported environment. PHP published its fixes at 13:34 UTC. Ten minutes later, Acquia began rolling them out, and all Acquia-hosted Drupal applications were patched within the same day. Customers’ sites stayed online throughout, and Acquia seamlessly automated the process, allowing customers to experience the following benefits: - About three hours: every application on [Acquia Cloud Next](https://www.acquia.com/request-a-demo/clickable-demo-form?product=Acquia%20Cloud%20Platform), including [Acquia Multi-Experience Operations](https://www.acquia.com/products/acquia-cloud-platform/multi-experience-operations) (MEO) and [Acquia Source](https://www.acquia.com/products/source/acquia-source-cms) sites, was patched in place. - Same day: every remaining Drupal Acquia-hosted application was patched. - Online throughout: no customer site was taken down to stay safe. - No customer action: nobody had to find packages, schedule a window, or wake up a developer. - No compromise found: Acquia's security team has found no indication that any customer or Acquia system was compromised. Three things made it possible for Acquia to streamline this fix: 1. Acquia builds its own PHP for customers, rather than waiting for an upstream distribution. 2. Acquia sits inside the disclosure circle, so the build was ready before the news broke. 3. And, lastly, Acquia owns the application layer, not just the servers, so patching is Acquia's job by design. Compare that with a self-managed team on the same day. They would learn about a leak from social media, find or build packages for each PHP version, test them, and deploy them across every environment, while a leaked exploit video circulates. Faced with that list, some teams made the same call the governments did and went dark. The fastest results came on Acquia Cloud Next, our container-based platform, which patched the full fleet in about three hours. That speed is one reason we are moving every customer onto it. ## What we learned, and what we are changing Customer applications were patched fast, but some of Acquia's own management services were not. They depended on packages from a third-party cloud provider that had not shipped its fix yet. Rather than leave them exposed, we took them offline to protect our customers. Customers could not sign in to Acquia, deploy code, or open a support ticket online, but their sites stayed up and phone support continued to be available. Prioritizing security was the right thing to do in this scenario, but understand it affected teams that wanted to act while the news was breaking. The lesson applies to every organization reading this. In the AI era, your exposure includes everything you depend on, not only your own code. We learned that about our own control plane, and we are acting on it to make the following improvements: - Faster patching across our full technology stack, including the third-party components our platform depends on. - Keeping Acquia tools available during security events, wherever we safely can. - Status updates through channels that stay up, even when our platform does not. - More frequent updates during any critical security event, even when the update is that we are still working on it. ## Questions to ask your platform before the next threat AI will find the next critical flaw faster than it found this one. Before it does, be sure to ask these questions to whoever runs your PHP applications: 1. When PHP published its fix on 21 October 2026, how many hours passed before every one of our production sites was running it? 2. Did any of our sites go offline to prioritize security? 3. Does our provider build its own language runtime, or wait on an upstream distribution? 4. Is our provider inside the embargo circle for PHP security releases? 5. What did our own team have to do that day, and how many of them were up at 2 a.m. working on it? If the responses were measured in days, or the honest answer to the last question was "most of us," the next security threat will cost even more than this one did. PHP2Shell is the first critical flaw of the AI era at internet scale. The next one will arrive faster and be found by more researchers and more models on both sides. The question for every organization is whether its platform patched before its team heard the news. Acquia Cloud Platform is the fully managed platform for enterprise Drupal. Infrastructure, security, compliance, and scaling are our job, so your team can build. [Talk to Acquia](https://www.acquia.com/cloud-platform-demo-request?gad_campaignid=23734781179&gad_source=1&gbraid=0AAAAAC9Vrh1qpygJBQ8Uf_agxbw6f1P1j&gclid=CjwKCAiAhqHXBhAXEiwATbksU5TrDIF4FQHKHM32LxeQ0AvJ7UNlTeXIhIEtuq9WUmb47M_duZBzihoCZ9oQAvD_BwE&utm_campaign=Search_WW_Google_ads_ACP_2025_DXP_Q32025&utm_content=701Pb00002L7m9GIAR&utm_medium=cpc&utm_source=google&utm_term=acquia%20cloud%20enterprise) about moving to Acquia Cloud Next. Image ![John Money](/sites/default/files/styles/post_content_attribution_headshot/public/media/image/2026-11/Blue.png?h=3cd06fc8&itok=NGTm7jm1) [John Money](/about-us/team/john-money) Director, Product Marketing, Platform & Drupal Acquia [Share this blog post on LinkedIn ](https://www.linkedin.com/sharing/share-offsite/?url=https://www.acquia.com/blog/php2shell-and-new-clock-patching) [Share this blog post on Twitter ]() [Share this blog post via Email ]() Copy Markdown