Subscribe
Over the past few days, one topic has dominated the cybersecurity world: PHP2Shell. This is a pair of critical vulnerabilities in PHP, the programming language that powers a large share of the world’s websites and web applications. They are tracked as CVE-2026-109618 and CVE-2026-109619, and both are rated 9.2 out of 10 on the CVSS v4.0 scale.
We want to tell our customers right away: all CodiCo systems have already been updated, and CodiCo Dispatch Software is fully protected against PHP2Shell. You don’t need to do anything, and your dispatch operation keeps running as usual.
What Happened
On October 20, 2026, information about two serious PHP vulnerabilities leaked online before the planned coordinated disclosure. The same evening, the PHP team published an advance notice of an emergency security release and urged all users to prepare to update immediately.
On October 21, 2026, the official fixes were released: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older branches that are no longer supported (PHP 8.1 and earlier) will not receive official patches.
According to Amazon Threat Intelligence, an attempt to exploit the vulnerability was recorded even earlier, on October 17, before the details became public.
Why PHP2Shell Is So Dangerous
What makes these vulnerabilities especially serious is how easy the attack can be:
- A single specially crafted web request can be enough.
- The attacker doesn’t need a login, a password or an account.
- The attack hits PHP itself before the website or application code even runs, so the application’s own protections can’t stop it.
- The result can be remote code execution, meaning the attacker gains the ability to run their own commands on the server.
Security researchers have confirmed that the vulnerabilities are real and that working exploits exist. Exploitation attempts were recorded shortly after disclosure, and experts warned that mass attacks would begin almost immediately after the patches were released.
How the Industry Is Responding
PHP2Shell has become one of the most talked-about security events of the year, and the whole industry is acting fast:
- Linux distributions and long-term support vendors received the patches early and are shipping updated packages.
- Cloudflare deployed protective firewall (WAF) rules for all its customers, including free plans.
- DigitalOcean published an urgent “patch now” notice. It is updating its managed services, has suspended affected one-click Marketplace images until they are patched, is notifying customers by email, and may temporarily restrict traffic to resources that show signs of compromise.
- The UK National Cyber Security Centre (NCSC) recommends taking offline any system that cannot be updated right away.
Experts agree on one thing: the only real fix is installing the patched PHP versions. Workarounds and configuration tweaks do not provide reliable protection.
What We Did at CodiCo
At CodiCo we keep a close eye on the security of our platform, because our customers’ daily work depends on it: bookings, dispatching, drivers and payments.
As soon as information about PHP2Shell appeared, our team:
- ✔️ applied the official PHP security updates;
- ✔️ updated all CodiCo servers and systems;
- ✔️ reviewed our infrastructure to make sure no unpatched components remain.
As a result, CodiCo Dispatch Software is fully protected against CVE-2026-109618 and CVE-2026-109619.
What This Means for Our Customers
You don’t need to do anything. Your CodiCo dispatch system is already running on updated, protected infrastructure. Bookings, drivers, customer data and payment information keep working as usual. You can focus on your business, and we’ll take care of security.
If you run other websites or services of your own on PHP, we strongly recommend checking with your hosting provider or IT team that they have been updated to the patched versions.
If you have any questions, our support team is always happy to help.
CodiCo Dispatch Software: we take care of security so you can take care of your business.
