The hosting provider reports that PHP is up to date. Good. The website still needs a look. A file added yesterday, a code change or a retained access route will not disappear with the update. This is where K-Shield works: monitoring, examining changes and allowing a return to an earlier state.
PHP starts working before WordPress
A request reaches the server. PHP starts processing it, then loads the application. That order explains the problem: in a demonstrated Apache mod_php scenario, one vulnerability can be exploited before WordPress and its firewall start working. The application filter is not there yet.
CVE-2026-109618 and CVE-2026-109619 concern memory handling: interrupted processing with incomplete internal data, or state reused after its backing memory has been freed. They can allow code execution without authentication. PHP-FPM and other web-serving modes are also affected.
The first intervention is therefore the PHP update. Fixes released on 21 October are included in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The provider may also supply a patched package. Check that the processes actually use the correction and arrange their restart.
Look at what changed
K-Shield inventories the code and compares it with the next inventory. A file appears, disappears or changes content or permissions: the observation is timestamped, its hash retained and an incident can be opened. There is then a path, a before-and-after state and a period to investigate.
The change needs explaining. A declared update may account for it. A K-Shield write can be recognised by its exact hash. Logins and timing provide further context. We bring those observations together to decide what follows, without turning an address or a country into the author’s identity.
Collection is periodic. It aims to shorten the interval between a change and its review, and depends on tasks running and files being readable. Exploitation without an observable change may escape it. A first inventory does not describe what happened before installation.
Harden where the measure can work
Some settings reduce exposure to particular attack paths while the update is arranged. They are prepared with the hosting provider at server, PHP-pool or upstream level. K-Shield reports the PHP version and certain observed settings to support that work.
One example needs precision: disabling upload-progress tracking must take effect before request parsing. PHP calls for an appropriate server or pool setting and worker restarts. Its advisory warns against relying on ini_set() or FPM .user.ini for this measure. Writing a setting and establishing that it works are separate operations.
These measures are temporary and partial. Permissions, accounts, backups and the firewall still need checking. Where patching is not possible, CERT-EU recommends considering isolation of the exposed application. The decision depends on the actual installation.
Go back without erasing the evidence
Take an existing code file whose modification remains unexplained. The engine can preserve the modified version in quarantine and restore an earlier copy with a matching hash. The modification remains available for examination. An eligible new file can be removed from the website through isolation.
Restoration requires a verifiable copy. Without one, the engine retains the alert and refuses that restoration. A matching hash establishes the restored content; examination must still determine whether the earlier state was clean. Releasing containment requires explicit approval and checks.
We have also bounded the automation. Mass changes, a file changed again after containment or insufficient context can require a human decision. The register retains the request, result and checks. The intervention can be revisited and understood.
Keep control of several websites
Opening each administration to check whether a scan finished or a backup exists soon becomes a job in itself. The WPSuite console gathers those observations and allows authorised scans, backups and incident responses according to configuration. Exchanges are authenticated and results return to the console.
K-Shield is evolving detection and response for websites: observe files, connect traces, intervene and check the effect. Server protection and process monitoring complement that scope.
That connection between tools is what we build. A current version, an alert and an isolated file say different things. They need to be read together to decide the next intervention.
Sources and scope
This article describes K-Shield on 22 October 2026. PHP and CERT-EU advisories identify patched versions and temporary measures. The monitoring described covers the website and available traces; it does not cover the entire operating system or every form of exploitation.
For your website
Have several websites, hosting you do not manage yourself, or a need to know what is protected? We start with what is actually running, the available access and the recovery options. You can then see what can be done, by whom and in what order.