MarginTop Solutions Patches All Client Backends Within 24 Hours of Critical PHP2Shell Vulnerabilities

No signs of exploitation detected. Businesses running PHP are urged to update immediately.

KATHMANDU, Nepal, October 22, 2026 — MarginTop Solutions, a Nepal-based software development and IT outsourcing company, today announced that every client backend under its management has been updated to patched PHP releases following the disclosure of two critical vulnerabilities known as "PHP2Shell." The full rollout took 24 hours, and no signs of exploitation have been found on any client system.

What Happened

On October 20, the PHP security team gave advance notice of two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively nicknamed "PHP2Shell." Both are rated CVSS 9.2. They allow unauthenticated remote code execution on almost any PHP web server, meaning an attacker does not need a password or any prior access to take control of a vulnerable machine.

Further investigation by the MarginTop team found that Amazon Threat Intelligence had observed exploitation attempts as early as October 17, three days before the advance notice. That means attackers were probing for vulnerable servers before most site owners even knew the flaws existed.

"This was a serious one," the MarginTop engineering team said. Flaws of this kind are commonly used to install cryptocurrency miners such as XMRig, which quietly consume server resources and can open the door to further compromise.

How MarginTop Responded

Within 24 hours of the notice, MarginTop's engineers:

• Identified every client backend running PHP
• Applied the patched PHP release to each one
• Verified every update and reviewed systems for signs of compromise

No indicators of exploitation were found. MarginTop also credits its existing Cloudflare proxy layer, which sits in front of client applications, as a valuable line of defence while patching was under way. Because traffic reached client servers through the proxy rather than directly, the exposure window was reduced.

Roshan KC, CTO, MarginTop Solutions, "When a vulnerability like this lands, speed and discipline matter more than anything. Our clients trust us with their backends, and we treat that trust as an obligation that does not pause for weekends or festivals."

Action Required: Update PHP Now

If your servers run PHP, update to one of the fixed versions immediately:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Additional Steps to Reduce Exposure

Patching is the priority, but these measures make exploitation harder while you work:

• Follow the source maintainers. Follow PHP's maintainers on LinkedIn, Reddit or X so you hear about security notices early.
• Put a WAF or reverse proxy in front of your servers. Services like Cloudflare filter malicious traffic before it reaches your application.
• Tighten a few PHP and server settings.
  • session.upload_progress.enabled = 0
  • fatal_error_backtraces = 0
  • expose_php = Off
  • server_tokens off (in your web server configuration)
• Run services with least privilege. Never run web services as root, even inside a container.

Help Is Available

MarginTop Solutions is available to assist any business that needs help applying the fix, auditing a server, or setting up protective measures, including during the festive season.

Contact: margintopsolutions.com | hello@margintopsolutions.com

About MarginTop Solutions

MarginTop Solutions is a Kathmandu-based software development and IT outsourcing company founded in 2023. A team of 14 builds MVPs, custom software, web and mobile applications, and AI/ML solutions for clients across North America, Europe, India, Africa and the Gulf region. Every project includes six months of free post-launch maintenance and support.