Cybersecurity & maintenance
PHP2Shell: planning maintenance for your PHP application
The PHP security updates highlight why server patching belongs in an application maintenance plan. Here is what businesses should verify.
PHP released fixes for two critical vulnerabilities. The announced patched versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; some vendors supply backported fixes.
The KIMY perspective
For a business, the first challenge is ownership: does the hosting provider, agency or internal team maintain each layer? A working website does not establish that its runtime is patched. We recommend recording the runtime actually serving the application and requesting confirmation from its maintainer. Plan a verified backup, login and payment checks, and monitoring after the change. A web application firewall should not be treated as a substitute for patching. This is an operational checklist, not a diagnosis of any particular website.
What to check
- Map responsibility for every environment, including subdomains.
- Confirm patch status with your provider, including any backports.
- Test critical journeys after maintenance and record the change.