Your customer needs their website working and their server patched. With OpalSpan, you can give that job to Mech, the built-in AI agent: inspect the connected server, establish which PHP runtime serves the website, apply the appropriate security update and check the result. You provide the target and the change authority; the agent performs the device work.
The PHP emergency discussed as php2shell makes that workflow immediately relevant. On 21 October 2026, PHP released fixes for CVE-2026-109618 and CVE-2026-109619, two critical remote-code-execution vulnerabilities. The official PHP advisory calls for urgent updates across affected web-serving configurations, including PHP-FPM and Apache mod_php.
The stakes are visible: BBC reported precautionary closures involving the Dutch National Cyber Security Centre and public-health institute RIVM. Those closures show why operators need a dependable route from an advisory to a checked update. Here is how to use OpalSpan for that work on one server.
Give Mech a complete repair task
Start with an approved server connected to your OpalSpan workspace, with the operating-system access needed to maintain it. Open Mech and describe the website, the permitted change and the checks that matter to the customer. For example:
On web-prod-01, check the PHP runtime serving shop.example for CVE-2026-109618 and CVE-2026-109619. Identify the exact package source, web handler and affected services. Use the vendor's security advisory to establish whether this build is fixed. Prepare a recoverable backup and install the appropriate security update within the current supported PHP branch. A short PHP-FPM service restart is approved in this maintenance window. Verify the serving runtime, homepage, login and the agreed checkout smoke test afterwards. Keep the previous configuration and explain any remaining blocker. Stop before an OS reboot, a PHP branch migration or a change requiring new spending.
This is an illustrative workflow, using a fictional server and website. It describes work to delegate, not a completed customer repair or a measured speed claim. Mech carries out authorized commands and file work through OpalSpan using the server's actual tools. A hosting provider that controls PHP for you may own part of the change; Mech can establish that boundary and prepare the precise request.
If you already work with Claude Code, Codex or another assistant, that agent can use OpalSpan Agent CLI for authorized device work under the same product permissions. You continue directing the outcome rather than manually driving a remote terminal.
Let the agent find the PHP your website actually uses
A server can have several PHP installations. The php command on its shell might report a different version from the FPM pool serving the shop, an Apache module or a container image. Mech's first useful job is to connect the website to the process and package that actually execute its requests.
On a Debian-family host whose approved package repository provides PHP 8.4, the investigation might include:
php -v
php --ini
dpkg-query -W php8.4-fpm php8.4-common php8.4-cli
apt-cache policy php8.4-fpm php8.4-common php8.4-cli
systemctl status php8.4-fpm --no-pager
These are example inspection commands for that specific package layout. Mech should discover the installed names first and use the appropriate tools for another distribution, container or hosting panel. Package-manager metadata may need an authorized refresh before its update candidate is current.
The agent then checks the website's configured handler, pool or container and the active worker processes. A shell version is one observation in that investigation. For web-runtime verification, use existing authenticated administration, a restricted application-health mechanism or the host's supported method; avoid leaving a public phpinfo() page behind.
The result you want is precise: this website is served by this runtime, supplied by this vendor, and this advisory establishes its patch status. That gives Mech a concrete update target.
Apply the security fix that fits this server
PHP's 21 October release identifies these upstream fixed versions:
| PHP branch | First fixed release for this emergency |
|---|---|
| 8.2 | 8.2.35 |
| 8.3 | 8.3.36 |
| 8.4 | 8.4.27 |
| 8.5 | 8.5.12 |
Use a later security-fixed release where appropriate. A distribution may backport the fixes into a package with a different version string, so Mech should compare the exact installed build with the vendor's advisory. The CERT-EU advisory and PHP's own announcement explain the wider update requirement. PHP 8.1 and older are upstream end-of-life; exceptional source patches do not restore normal support.
For our example, suppose the website runs an unpatched PHP 8.4 build and its approved repository offers a fixed maintenance release. Mech can preserve the relevant configuration, verify the agreed recovery path, inspect the package transaction and update the serving runtime together with its required matching packages. It can identify extension or configuration conflicts before attempting to return the site to service.
That is a useful reason to put an agent on the machine: the task includes reading the actual environment, carrying out the change and responding to what happens. If the repair instead needs a branch migration or an incompatible application change, Mech can prepare that larger path with the evidence already collected. Our WordPress PHP upgrade guide covers that situation.
PHP says configuration workarounds are not a complete substitute for the update. Keep temporary exposure restrictions in place when the approved fix cannot yet be installed.
Restart the affected service, then prove the website works
Installing new files is only part of the job. Existing workers can still be running old code. Mech should follow the package and service vendor's instructions to replace the affected processes and then verify the new serving state.
For the example FPM host, this may be an approved restart of its exact PHP-FPM unit. Apache module deployments, containers and other handlers have different replacement procedures. A graceful reload is sufficient only if it actually retires the vulnerable workers. A complete server reboot is a separate, more disruptive decision.
Give Mech business checks as well as process checks:
- Confirm the expected fixed package or image and the runtime serving new requests.
- Check service readiness and the relevant recent error logs.
- Open the homepage and exercise an approved login, form or checkout smoke test without creating an unintended purchase or contacting real customers.
- Check any relevant PHP-backed jobs or workers that also needed replacement.
- Record what changed, what passed and what still needs attention.
An HTTP 200 response alone cannot establish that checkout works. Equally, a successful security update does not establish that earlier compromise was absent. Suspicious files, unexpected accounts or concerning log evidence belong in an incident-response investigation; the UK NCSC guidance explains why exposure and remediation both matter.
Turn this repair into useful capacity
OpalSpan gives you a way to delegate the server work your customer needs delivered: establish the cause for action, make the authorized change, inspect the result and keep the context available for the next person. Start with one server and an outcome you can verify, then extend the same approach to an approved server fleet.
Start with OpalSpan: connect your first approved server and give Mech the PHP update task. The current plans and Mech credit options explain how to put that agent capacity to work. Your existing external assistant remains another route through Agent CLI.
Sources
Security facts checked 22 October 2026. Recheck current vendor guidance before acting on a server.
- PHP: emergency security advisory and fixed releases.
- Official CVE record: CVE-2026-109618 and CVE-2026-109619.
- PHP GitHub advisory: RCE via OOM corruption and RCE via stale global state.
- CERT-EU: Critical Vulnerabilities in PHP.
- BBC: Websites taken down worldwide as critical cyber-security update issued.
- UK NCSC: Critical security issue affecting PHP.