# Google and Mandiant Warn PHP Servers Remain Vulnerable

Google Cloud and Mandiant Consulting warn that installing patched PHP packages may leave applications exposed if older PHP processes continue running. Administrators should restart the relevant services and confirm the active runtime is using a fixed release; the signal lists PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 as initial fixed upstream versions. Amazon Threat Intelligence observed early exploitation attempts on October 17, so affected organizations are advised to review logs from that date and preserve volatile evidence before restarting if compromise is suspected.

- Government contractors and service providers operating PHP applications should verify running PHP-FPM or other relevant processes—not just installed package versions—and account for containerized or chrooted deployments.
- This highlights an operational security risk for agencies relying on contractor-hosted applications: patch deployment alone may not close exposure without service restarts and runtime verification.
- Organizations should review logs back to October 17 for signs of exploitation and preserve volatile evidence before restarting systems when compromise is suspected.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** October 25, 2026

### Vendors
- Google Cloud ()
- Mandiant Consulting ()
- Amazon Threat Intelligence ()

### Key Quotes
> One detail affecting many Debian/Ubuntu and cPanel/HestiaCP administrators right now: running apt upgrade on php8.x-fpm updates the binary on disk, but if master PHP-FPM worker pools aren't gracefully reloaded (or if a containerized/chrooted pool still references the old inode in memory)—or if CGI/FastCGI environment-variable pass-through in nginx/Apache fastcgi_param isn't locked down—the endpoint stays exploitable even when dpkg -l shows the patched package version.
> — Commenter

### Sources
- [PHP2Shell: Google and Mandiant Warn That PHP Servers May Remain Vulnerable After Installing Patches](https://www.reddit.com/r/cybersecurity/comments/1xf3i0w/php2shell_google_and_mandiant_warn_that_php) - reddit-cybersecurity