Shetu Cloud in Dhaka works a ten-day response to two critical PHP engine flaws: CVE-2026-109618, memory corruption in out-of-memory handling, and CVE-2026-109619, a use-after-free from reused worker state, both allowing unauthenticated remote code execution; the fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with 8.1 and older end-of-life and un-fixable; a fleet verification from two independent sources — package reports say 97 of 97, a live php -v sweep says 94 of 97 and an outside-in scan agrees — so three stragglers are chased by name; and the eight-section response plan: understand, inventory, patch, mitigate, verify, respond, harden, programme.

CY-MID-112Mid Level · Vulnerability Management

PHP2Shell — Defending Against Critical PHP RCE (CVE-2026-109618 & CVE-2026-109619) (English + বাংলা)

A ten-hour, hands-on defender's course on the two critical PHP engine vulnerabilities disclosed in October 2026: understand how they work, find every affected PHP in your estate, patch and restart workers the right way, apply interim mitigations when you cannot patch yet, prove the fix, prepare the incident runbook, and build a programme that handles the next critical CVE. Switch between English and বাংলা at any time.

10 hours10 chapters40 lessons287 activities10 labs

What you'll learn

Explain CVE-2026-109618 and CVE-2026-109619 in plain terms and why they allow unauthenticated remote code execution regardless of application code.
Inventory every PHP engine in an environment — hosts, containers, appliances and CMS bundles — and prioritise by exposure and end-of-life status.
Apply the official fix across packages, containers and compiled builds, restart every worker, verify the fix from independent sources and keep the evidence.
Apply honest interim mitigations, be ready to run a structured incident response, harden PHP-FPM for the long run, and stand up a repeatable remediation programme.

Price:৳8,000