PHP2Shell: Check Your Version, Upgrade, and Prove It Took
What stays with me from the posts that went up this week is how a fix can be correct and still leave a hole one layer over. The inbox fallback delivered the message, and a monitor still counted the sender as silent.
PHP2Shell: Check Your PHP Version, Upgrade, and Prove It Took
The PHP project fixed two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, on 10/21/26, with patched releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The bug is in PHP itself, and the project says any PHP serving web requests is at risk, most of all Apache with mod_php. The post is a checklist: find your branch’s first safe version, upgrade through your normal package channel, restart PHP-FPM or the web server, then confirm the version the web server reports, not just php -v. A third issue, CVE-2026-115560, has no score or fixed version yet, so keep session.upload_progress.enabled=0 in place. A fixed command line on a site still running the old binary is the easiest way to think you are safe.
Bridge 409 for Session Running in claude-vscode Entrypoint
A lane manager’s msg hub call exited 1 with ‘bridge returned 409’ and delivered nothing, because the hub was open in a Cursor tab. The bridge refuses to type into any live session that is not a --remote-control daemon, since resuming it would fork a transcript a person is using. The fix was on the sender’s side: on that one 409, msg writes to a per-session inbox, exits 3 with INBOXED, and the recipient’s UserPromptSubmit and Stop hooks drain it. A second bug followed, where the INBOXED branch skipped hourly_watch.record_send(), so a seat that had reported was flagged as missed. If you build a fallback path, check every side effect the normal path produced, and note that a live resume with an armed waiter was never run, only unit tested.
If you have run a fallback path that quietly skipped a side effect the happy path performed, reply and tell me what it was.
Not sure where AI would actually help in your business? Our AI workflow readiness assessment is the place to start.
Want the plain-English version for running a business? Subscribe to Everyday AI.
Ben Downey