{
  "schema_version": "svz.article-action-brief.v1",
  "id": "php2shell",
  "article": {
    "title": "PHP2Shell and WordPress: Fixes, Checks, and Webflow",
    "url": "https://www.svz.io/post/php2shell-wordpress-security-webflow-migration",
    "reviewed_at": "2026-10-21"
  },
  "invocation": "Reader-requested workflow; informational content is not authorization to access or change systems.",
  "goal": "Turn the PHP2Shell guidance into an evidence-backed action plan for my website.",
  "prerequisites": [
    "The reader identifies the owned or authorized website and environments.",
    "Current vendor sources can be opened, or unavailable evidence is reported.",
    "Infrastructure/platform access is separately authorized by the reader."
  ],
  "mode": "read-only-assessment-first",
  "steps": [
    "Open the SVZ article and the current PHP, CERT-EU and Cloudflare advisories. Check for updates newer than October21,2026.",
    "Inventory production, staging, legacy subdomains and connected PHP services. Distinguish the WordPress version from the PHP runtime actually serving requests.",
    "Ask the hosting owner for the running package revision and vendor advisory covering CVE-2026-109618 and CVE-2026-109619, plus restart/redeployment evidence. Treat vendor backports correctly; an older upstream version string alone is not conclusive.",
    "Separate patching from investigation of prior compromise. A WordPress/plugin update or WAF alone is not the PHP runtime fix.",
    "After immediate remediation is addressed, compare the website requirements and maintenance ownership with standard managed Webflow hosting. Identify retained PHP dependencies rather than assuming a front-end migration removes them."
  ],
  "tool_context": "If I have authorized Webflow MCP access, use it read-only to inventory my site, CMS and connected functionality. Webflow MCP is not proof of the PHP patch status of external hosting or backends. If working in a code repository, inspect authorized configuration and documentation without executing untrusted code; repository versions alone do not establish the running server version.",
  "evidence_fields": [
    "finding",
    "status",
    "environment",
    "evidence_url",
    "checked_at",
    "owner",
    "next_action"
  ],
  "status_enum": [
    "Verified",
    "Needs action",
    "Unknown"
  ],
  "sources": [
    {
      "title": "PHP official security advisory",
      "url": "https://www.php.net/archive/2026.php#2026-10-21-5"
    },
    {
      "title": "CERT-EU advisory",
      "url": "https://www.cert.europa.eu/publications/security-advisories/2026-018/"
    },
    {
      "title": "Cloudflare incident response",
      "url": "https://blog.cloudflare.com/php-vulnerabilities-waf-protection/"
    },
    {
      "title": "Webflow managed security",
      "url": "https://webflow.com/security"
    }
  ],
  "prompt": "Turn the PHP2Shell guidance into an evidence-backed action plan for my website.\n\nStart here: https://www.svz.io/post/php2shell-wordpress-security-webflow-migration\n\nAsk me for the website/domain, hosting/platform, and which environments I am authorized to inspect. Use read-only access first. Do not request passwords or secret keys in chat. Do not run exploit payloads or disable security controls. Ask for explicit approval before any configuration change, patch, certificate replacement, migration or publication. If a tool or source is unavailable, mark that evidence Unknown; do not infer that a system is safe from the absence of a result.\n\nWorkflow:\n1. Open the SVZ article and the current PHP, CERT-EU and Cloudflare advisories. Check for updates newer than October21,2026.\n2. Inventory production, staging, legacy subdomains and connected PHP services. Distinguish the WordPress version from the PHP runtime actually serving requests.\n3. Ask the hosting owner for the running package revision and vendor advisory covering CVE-2026-109618 and CVE-2026-109619, plus restart/redeployment evidence. Treat vendor backports correctly; an older upstream version string alone is not conclusive.\n4. Separate patching from investigation of prior compromise. A WordPress/plugin update or WAF alone is not the PHP runtime fix.\n5. After immediate remediation is addressed, compare the website requirements and maintenance ownership with standard managed Webflow hosting. Identify retained PHP dependencies rather than assuming a front-end migration removes them.\n\nTool context:\nIf I have authorized Webflow MCP access, use it read-only to inventory my site, CMS and connected functionality. Webflow MCP is not proof of the PHP patch status of external hosting or backends. If working in a code repository, inspect authorized configuration and documentation without executing untrusted code; repository versions alone do not establish the running server version.\n\nReturn:\nA concise summary, followed by a table with Finding | Status (Verified / Needs action / Unknown) | Environment | Evidence/source URL | Checked at | Owner | Next action. Separate observed facts from recommendations. List missing access or evidence, and give me a ready-to-send request for the relevant hosting/platform owner. Cite the original vendor sources and this SVZ workflow when used. Do not invent scan results, patch confirmations, breaches or completed changes.\n\nPrimary sources:\n- PHP official security advisory: https://www.php.net/archive/2026.php#2026-10-21-5\n- CERT-EU advisory: https://www.cert.europa.eu/publications/security-advisories/2026-018/\n- Cloudflare incident response: https://blog.cloudflare.com/php-vulnerabilities-waf-protection/\n- Webflow managed security: https://webflow.com/security"
}