We fact-checked all 27 incidents in the viral "Black October" list: PHP2Shell, eMudhra, SBI, GitLab, LiteLLM, UpdraftPlus and more. What is real, what is exaggerated, and what Indian organisations should patch now.
On shared hosting you can’t patch PHP yourself, but you can still check your exposure to PHP2Shell, ask your host the right questions and look for signs of compromise. Here’s how in 15 minutes.
A step-by-step guide to finding every PHP install on your Linux server, patching PHP2Shell (CVE-2026-109618/109619), verifying the fix and checking for signs of compromise.
PHP2Shell is a pair of critical (CVSS 9.2) PHP flaws that allow unauthenticated remote code execution. Here is what happened, which versions are affected, and what to do first.
