DEV Community: Cristishor201

PHP2Shell: How I patched the critical PHP RCE vulnerability in my Infrastructure

Cristishor201 — Tue, 27 Oct 2026 20:54:05 +0000

News

Real Problem

I have documented with the help of AI, and this is what I managed to come up with.
It’s about some critical vulnerabilities PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow PHP memory exploitation, and execute remote code (RCE) without authentication.

This is done by POST requests, which inject malicious code, which through heap corruption tricks memory pointers into accepting the payload instead of real files. Once the payload bypasses this threshold, instructions are fed to the processor for execution. And then PHP files are installed which act as backdoors, through which the hacker can login later using these endpoints.

PHP is written in C and uses the Zend Engine to manage pointers, which in the end executes php scripts. Surprisingly PHP is Open-Source, which means everyone can access Zend Engine, even the attackers.
WordPress and the LAMP stack are the main targets, because they are omnipresent on the internet and an automated scanner finds them in seconds.

How I solved it

Firstly, I identified the applications from the micro-services which use php, and then I checked in the verssion through php -v.

Then I have asked AI, which are the correction versions which contains the patch.

PHP branch	Vulnerable Version	Secure Version (patched)	Branch Status
`PHP 8.2`	`< 8.2.35`	`8.2.35` (or newer)	Security Support
`PHP 8.3`	`< 8.3.36`	`8.3.36` (or newer)	Active
`PHP 8.4`	`< 8.4.27`	`8.4.27` (or newer)	Active
`PHP 8.5`	`< 8.5.12`	`8.5.12` (or newer)	Current Version

• For Firefly I used
docker compose pull && docker compose up -d
for updating my own instance, and now I am up to date.
• For the LAMP stack I used generic images like php:8.3-apache / php:8.4-apache / php:8.5-apache, and of course updated with pull image and prune within the Portainer.

At Wordpress I didn’t reach yet with my website, but I would do the modification in Portainer as well.

Infiltration Checks

After I closed up the vulnerability, I started a system check, to see what files had been uploaded or which are the damages, if any.

In the containers which runs PHP, I searched in Portainer by terms:

• PHPSESSID
• multipart/form-data

Future improvements

I am still thinking if I want to use a service like WatchTower for automatically updating containers, and so closing the window of vulnerability. The reason it’s that not all updates are good, like it happened with Windows, and I rather prefer more control.

CrowdSec seems the best approach to these PHP attacks.

How I split my AI workload in 2026

Cristishor201 — Fri, 24 Jul 2026 20:36:25 +0000

On the Artificial Intelligence (AI) front, I use:

Gemini - general stuff (psychological, medicine, relationships, politics, jobs, legal / official matters). I also used image generation and video analysis.
DeepSeek – code issues, programming, even debugging
Claude - UI design of frontend development

Overall, I use Gemini most of the time.

What do you do when you find a new error on google chrome in the middle of the night ?

Cristishor201 — Fri, 24 Jul 2026 06:00:00 +0000

Yesterday at 4 AM, I booted up the PC (courtesy of a noisy neighbor), and I came across the DNS_PROBE_STARTED error, which quickly became a challenge.

What I tried

I ran the Windows Troubleshooter, and ended up with DNS_PROBE_FINISHED_NO_INTERNET, which I have to admit, I hadn’t come across errors like these before.

Unplugged the router power socket for 30 sec
Reset DNS configurations:

ipconfig /flushdns
ipconfig /release
ipconfig /renew
netsh winsock reset
netsh int ip reset

Changed DNS servers, ending up with the mix of Cloudflare and Google
Cleared Chrome’s DNS cache chrome://net-internals/#dns and reset all experimental flags chrome://flags/
Isolated the issue by testing edge browser and smartphone, where I got the same error, which confirmed it was a local network problem
Checked downdetector.ro but no outages were reported.
Tried Bitdefender VPN, which failed with Error code 9 - no internet
Unplugged the router, disconnected the fiber optic cable for 2 minutes, plugged the fiber back in, and then reconnected the power.

What actually worked

In the end, I contacted my ISP, and I opened 2 tickets because I wasn’t sure which email was the right one.
The dispatcher on the phone told me that my fiber optic line might be damaged.
A technician came over, inspected the fiber optic tip, and used a digital meter, to check the signal power.He then sprayed a special optical cleaning solution inside the router port … and it worked.
I felt a bit silly because the fix was so simple, yet I hadn’t even considered it. I really didn’t think that the dust from the floor could get inside the router, and affect the internet connection.
Granted, my router is sitting on the floor, but it’s not like my home lab has a better spot. I am considering a rack in the future, but those are pricey , so it will take a while.

Next steps:

I researched that signal measuring tool, so I can include optical power values in future support tickets and be better prepared. I also found out about one-click cleaner , but it’s quite expensive, which explains why the technician used the spray instead.