PHP2Shell: łatka PHP już jest, ale strony na WordPressie muszą czekać na hostingodawcę – Martin Cid Magazine PL

PHP2Shell: łatka PHP już jest, ale strony na WordPressie muszą czekać na hostingodawcę – Martin Cid Magazine PL

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page pl/news/pl-martincid/technology-pl-php2shell-latka-php-juz-jest-ale-strony-na-wor, snapshot 20261024T083755Z. Copied byte for byte; every file's sha256 is in captures/20261024T083755Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

Martin Cid Magazine Polska (Polish), 21 October: why WordPress sites must wait for their host rather than update themselves. It says the flaws are in PHP itself, below the CMS, so a WordPress update changes nothing; PHP covers every web-request set-up (FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed), citing The Hacker News that an attack works even against a default 'Hello World' page, and that the worst case is mod_php. Wordfence says the patch cannot arrive through automatic updates, and Laravel Forge says Ubuntu's unattended upgrades do not cover PHP installed from outside packages. On package-source timing, mySites.guru reported that cPanel EasyApache 4 had fixed builds within minutes while Ondřej Surý's PPA and Remi's repository did not yet; only 0.08% of the active sites it monitors showed a fixed PHP at 13:52 UTC. It warns that backports by Ubuntu, Debian and Red Hat keep the old version number, so version checks mislead, and that long-running processes must be restarted. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and older get no fix from the project beyond minimal source patches.

> Wśród aktywnych witryn monitorowanych przez mySites.guru o 13:52 UTC poprawioną wersję PHP zgłaszało 0,08%.

_Curator's translation:_ "Among the active sites monitored by mySites.guru at 13:52 UTC, 0.08% reported a patched PHP version."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell: łatka PHP już jest, ale strony na WordPressie muszą czekać na hostingodawcę – Martin Cid Magazine PL". Selected mechanically, not read by a person.

Capture notes

Language pl-PL. Nothing in the page addresses an AI or hides text from a reader.