Nothing here for PHP2Shell

On Wednesday PHP shipped emergency releases for two flaws in its core, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. A single request from somebody who never logged in can be enough to run code on the web server, and every PHP installation that serves web requests is affected, whatever runs on top of it. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; anything older needs a backport from a vendor or a patch built from source.

A site built with ./blog.sh has nothing for it to hit. There is no PHP in it, no database behind it and no admin page in front of it. What the web server hands out are files the build wrote earlier: pages, a stylesheet, a search index, pictures. A request can ask for one of them and get it, and that is all a request can do; nothing on the server runs because somebody asked. That is not a hardening step somebody remembered to take. It is what Built for one blog on purpose meant by "nothing needs a security patch on a Tuesday". This time it was a Wednesday.

It does not mean nothing ever needs an update. The web server that serves the files does, SSH does if you write from a phone, and so does Ruby on the machine that builds. What's left to get wrong walks through that short list. It is simply much shorter than the list of a PHP stack, and nothing on it was on fire this week.

One practical note if you came here from WordPress: the import copied your posts, but it did not switch the old site off. If an old WordPress install is still answering somewhere, update its PHP today, or take it down.