Patch PHP2Shell today. End the fire drills for good.
What’s at stake: two critical PHP zero-days give attackers a path to full server control, and versions 8.1 and older will never be patched. What to do: patch today, then modernize the legacy code behind it so the next disclosure is routine, not a crisis. Opsera Forge covers both steps.
CVE-2026-109618 · CVE-2026-109619 · CVSS v4.0 9.2
Bring one PHP application. Leave with a plan for the first wave.
A working session with a Forge engineer, on your application. By submitting you agree to the Privacy policy.
It’s in the runtime, not your code. Your code can clear SAST and code review and still be exposed, because scanners never look at the engine.
No login required. A crafted request runs before authentication ever gets a say.
Older versions stay exposed. ~59% of internet-facing PHP is on 8.1 or older, with no patch coming, and 8.2 reaches end of life on Dec 31.
Find it. Look past your repos for every PHP install: container images, CI configurations and third-party software.
Patch it. Move supported branches to 8.2.35, 8.3.36, 8.4.27 or 8.5.12.
Isolate it. Pull anything on 8.1 or older off the public internet until it’s upgraded.
Patching gets you through this one. Modernizing gets you past the next.
Run on supported versions
Leave end-of-life PHP behind, so when the next flaw is disclosed, there’s a fix waiting for you.
Unlock buried business logic
Make the brittle code everyone avoids readable, so your team can change it without fear.
Move faster, more safely
Clear out the tech debt attackers find before your team does, and cut time to market from 2 weeks to 2 days.
The Software Factory for Continuous Modernization
- Find
- Each runtime across your estate, even the ones no one remembers standing up.
- See
- What a fix will touch, before it goes out the door.
- Modernize
- AI agents that keep their context and stay inside guardrails, all the way to production.
1 Map
Chart the application, its runtimes and everything it depends on.
2 Baseline
Measure where it stands with ForgeScore.
3 Scope
Define the first wave of changes.
4 Modernize
Deliver governed changes, one wave at a time.
[Video title] From fire drill to modernization plan
[Video description] See Forge find every PHP runtime in an estate, show the blast radius of a fix before it ships, and scope the first wave of modernization for an application stuck on 8.1 or older.
- Find: every runtime, including the forgotten ones
- See: the blast radius before you ship
- Modernize: governed change, wave by wave
Modernize today. Stay calm tomorrow.
Find out how to modernize your PHP applications and get ahead of the next vulnerability.