Global – November 04, 2026 -- CIQ released fixed PHP packages for Rocky Linux from CIQ Pro (RLC Pro) LTS 9.6 and 9.2 about three and a half hours after the upstream PHP2Shell fix went public, covering PHP 8.0, a version upstream no longer supports. Fixes for the php:7.4 and php:8.2 module streams followed over the next two days.
Upstream fixes skip PHP 7.2, 7.3 and 5.4
The PHP project released fixes for PHP 8.2 through 8.5 and published source-only fix branches for 7.4, 8.0 and 8.1. It released nothing for 7.2 and 7.3, or for the PHP 5.4 that CentOS 7 ships. Teams that self-support those versions must build and test the fix themselves, or the version stays exposed.
PHP2Shell remediation pulls engineers off customer roadmaps
The PHP2Shell knowledge base article sets out a seven-step response: find every PHP install, including appliances that bundle their own runtime; identify each version; map exposure; apply interim settings; rebuild container images; install fixes and restart every PHP process; and revert the interim settings.
On Enterprise Linux 8, version identification includes the module stream (7.2, 7.4, 8.0 or 8.2), each with a different fix status. Apache with mod_php is the most exposed configuration, and internet-facing servers come before internal ones. The PHP security team warns that interim settings reduce exposure without removing it.
Rocky Linux 8 and 9 put several unsupported PHP versions in production
Upstream patched PHP 8.2 and later. Rocky Linux 9 ships PHP 8.0, and Rocky Linux 8 ships 7.2, 7.4 and 8.0 as module streams, so a single Enterprise Linux release can run multiple versions with no upstream fix.
AI-assisted research doubles monthly disclosures
Google's threat intelligence group found that monthly vulnerability disclosures doubled from January to July 2026. Half of the vulnerabilities it identified as likely AI-discovered lead to remote code execution.
The PHP security team has published 15 CVEs since July 1 and worked through more than 100 reports that were invalid, duplicates or not reproducible. It spent months choosing between competing fixes for CVE-2026-109618, according to the PHP Foundation, because each option traded against compatibility, denial-of-service risk or third-party extensions. Engineers backporting that fix to older branches must weigh the same trade-offs.
CIQ takes on backporting while customers keep the rollout
CIQ engineers triaged, backported and validated a run of Linux kernel CVEs through the spring, and the company says each one refined the process. Under RLC Pro, CIQ supplies tested packages and the knowledge base article. Customer engineers still schedule updates, restart services, rebuild container images and obtain vendor updates for software that bundles its own PHP. CIQ handles reading the upstream patch, backporting it and validating the build.
CIQ advises leaders to quantify the cost internally: take the engineer-days spent on PHP2Shell from first advisory to the last reverted setting, then multiply by the critical CVEs expected in the next year in the software they run.