On 21 October 2026, the PHP project published security updates for two critical vulnerabilities affecting web-serving PHP installations. This is a timely reminder that owning business software and maintaining it securely are separate responsibilities.
What is PHP2Shell?
On 21 October 2026, the PHP project released security fixes for CVE-2026-109618 and CVE-2026-109619, two critical memory-safety vulnerabilities collectively known as PHP2Shell. They can allow unauthenticated remote code execution on affected servers. Fixed releases include PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CERT-EU advised organisations to patch affected systems immediately.
This is an industry-wide issue affecting potentially vulnerable PHP-based services, not evidence that a particular SaaS provider suffered a breach. Exposure and impact depend on the deployed PHP version, configuration, patching and compensating controls.
The security responsibilities behind business software
Purchasing a licence for a self-hosted application does not automatically include server administration, operating-system and runtime patches, backups, vulnerability monitoring, incident response or compatibility upgrades. Those responsibilities remain with the business or its contracted IT provider unless explicitly covered by a maintenance agreement.
The managed SaaS advantage
In a managed SaaS arrangement, the provider typically operates the hosting environment, applies platform security patches, maintains the application and coordinates vulnerability response. Rather than hundreds of customers independently administering servers, specialist teams can roll out and verify centralised fixes. The precise scope depends on the provider’s service agreement.
SaaS is not immune to security incidents, and no provider can promise zero downtime or zero vulnerabilities. Customers still need to protect accounts, endpoints and permissions; the provider remains responsible for the services and security controls it has agreed to operate.
Is taking software offline the only option?
Temporarily isolating a vulnerable internet-facing system may reduce exposure while patches are deployed, but taking every business application permanently offline is not the general solution. Offline computers still face malware, local security weaknesses, hardware failures and data-loss risks. The sustainable response is timely patching, appropriate monitoring, tested backups and clear responsibility for maintenance.
Understand the full cost of ownership
- Managed SaaS: recurring service fees commonly cover provider-operated hosting, platform updates, availability management and agreed maintenance.
- Self-hosted / one-time-licence software: the initial licence may be paid once, but infrastructure, technical labour, patches, backups and incident handling continue to carry costs.
- Offline software: can work without a live internet connection, but still requires endpoint protection, backups and an agreed upgrade and support policy.
Before choosing any business software, ask who is accountable for security patches, what response process is available when vulnerabilities arise, how backups are recovered and what ongoing maintenance costs are included.
Official references
- PHP security releases, 21 October 2026
- CERT-EU Security Advisory 2026-018
- Ubuntu security notice, 21 October 2026
This is an educational article about PHP2Shell and software deployment models. It does not imply that any named SaaS provider was compromised.