PHP2Shell MSP Response Toolkit | VERSION 1.2 | Updated 2026-10-23

Free, editable, unbranded defensive resource for MSPs and customer organizations.
Use the latest authoritative security and vendor notices before making any change.

WHAT CHANGED SINCE V1.1 (22 OCT)
- Sophos corrected its earlier customer-compromise report on 22 Oct 21:21 UTC. Its telemetry showed scanning and failed/blocked attempts, including unsuccessful Potassium delivery. Attempted exploitation is NOT confirmed execution on a customer host.
- Arctic Wolf reported malicious payload retrieval attempts. It did NOT establish that the observed requests downloaded or executed malware on victims.
- VulnCheck reported expanded laboratory exploit coverage on 23 Oct for specific PHP 8.4 and 8.5 mod_php versions on AMD64/ARM64. Laboratory RCE is not confirmed malicious compromise.
- CloudLinux: stable native PHP fixes are available for affected streams, and updated alt-php / ea-php 8.2-8.5 packages with upstream-aligned numbers are in stable. Earlier verified backports may already be fixed.
- IMPORTANT CORRECTION: CloudLinux 23 Oct 21:36 UTC update says KEEP the ELS ALT PHP (php-els) repository enabled if added. This supersedes earlier advice to disable it. Also verify cloudlinux-release and cl-ea4 where applicable.
- Cisco advisory v1.6 (updated 23 Oct 22:39 GMT) lists affected Expressway Series and Expressway Select (15.5.21 target, TBD), Ultra-Reliable Wireless Backhaul (27.1.1, estimated Feb 2027; admin authentication needed), and Duo Access Gateway (fixed release 3.2.0). Product-specific workarounds and patch availability must be verified by Cisco bug.
- PHP on 23 Oct published a SEPARATE informational advisory for CVE-2026-115560, involving an unusual session serializer change. The recommended temporary control is session.upload_progress.enabled=0 until the next regular bugfix release for that issue; the PHP2Shell fixed versions address the original TWO CVEs, not necessarily this separate vulnerability.
- Hunt, patch verification, customer notice and closure sections distinguish scanning, blocked attempts, lab exploit and verified asset compromise.
- The three CSV trackers gain columns for confidence/evidence, repository state, Cisco bug IDs and separate CVE-2026-115560 mitigation evidence.
- Windows and Linux discovery helper scripts are unchanged from v1.1. They remain read-only leads and do not establish absence of PHP exposure.

CONTENTS
- PHP2Shell_MSP_Emergency_Response_Playbook_v1.2.docx
- Windows-PHP-Discovery.ps1 (unchanged, read-only leads)
- Linux-PHP-Discovery.sh (unchanged, read-only leads)
- Customer-Asset-Tracker.csv (expanded header)
- Vendor-Dependency-Tracker.csv (expanded header)
- Response-Decision-Log.csv (expanded header)
- CHANGELOG_v1.2.md (dated source-and-section register)

SAFETY / USE
- No exploit code, automatic patching, active remote probes or unauthenticated scans are included.
- Review scripts before deploying. Run only on systems you are authorized to administer.
- A negative script result does not establish the absence of affected PHP or appliance dependencies.
- Preserve logs and appropriate evidence before destructive changes if compromise is suspected.
- Treat IOC matches as leads. Confirm actual child process, file/network and host evidence before declaring execution or compromise.
- Store discovered customer data using controlled access, retention and handling practices.
- Use vendor-specific advisories to confirm a patched BACKPORT even if the visible PHP version is older than the upstream fixed number.

EXAMPLES
  .\Windows-PHP-Discovery.ps1 -OutputCsv .\windows-inventory.csv
  .\Windows-PHP-Discovery.ps1 -ExtraRoots 'D:\Apps','E:\Services'
  bash Linux-PHP-Discovery.sh > linux-inventory.txt

CRITICAL CURRENT LINKS
PHP: https://www.php.net/archive/2026.php
Sophos: https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619
CloudLinux status (supersedes earlier repo advice): https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5
CloudLinux package guide: https://cloudlinux.zendesk.com/hc/en-us/articles/31194180517916-PHP-CVE-2026-109618-CVE-2026-109619-PHP2Shell-fixed-alt-php-and-ea-php-packages-and-how-to-verify
Cisco: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq
VulnCheck: https://www.vulncheck.com/blog/php2shell-vulnerabilities
Arctic Wolf: https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/

LAST VERIFIED SOURCE SNAPSHOT: 23 Oct 2026 including CloudLinux 21:36 UTC correction, Cisco 22:39 UTC advisory and VulnCheck 17:30 ET update. Recheck before use.
