PHP2Shell: PHP webhook and workflow recovery checklist
Turing Automate | guidance checked 22 October 2026
CVE-2026-109618 / CVE-2026-109619

Current official PHP advisory and fixed releases:
https://www.php.net/archive/2026.php#2026-10-21-5
Use the current vendor advisory for remediation. This worksheet records
workflow delivery and acceptance checks; it is not a vulnerability scanner
or proof that a system is free of compromise.

ENDPOINT AND PATCH OWNER
Public hostname (no credentials or secret query strings):
Connected tools and endpoint purpose:
Hosting/provider contact responsible for PHP:
Serving runtime/package and vendor notice for both CVEs:
Host confirmation that the patched runtime is running:
Confirmation time and time zone:

AFFECTED WORK
First affected time / last correct result (include time zone):
Paused actions and manual handling owner:
Provider retry deadline and evidence of its policy:
Source ID list kept in our controlled account:
Counts: completed / missing / duplicate / uncertain / manually handled:

CONTROLLED ACCEPTANCE CHECKS
Test data and authorised recipient agreed:
One test event: intended record, owner, fields and action verified:
Retry of the same event: intended record/message count verified:
Invalid input and unavailable destination: review/alert verified:
Backlog compared with completed and manual work before replay:
First restored runs checked in the destination:
Result, checker, timestamp and remaining issue for each check:

REQUEST HELP
Business deadline and affected action:
Share public hostnames and redacted descriptions only. Keep passwords,
API keys, tokens, customer records and full logs in controlled systems.
https://turingautomate.com/brief?enquiry=automation-repair#enquiry
Full guide: https://turingautomate.com/resources/php2shell-php-webhook-automation-checks
Suspected compromise: contact hosting security support or a suitably
qualified incident-response provider alongside workflow repair.