PHP2Shell: runtime patch and reporting-feed handoff
Prepared 22 October 2026 by Turing BI
https://turingbi.com/insights/php2shell-power-bi-data-feed-checks

Fill this in with your hosting and reporting owners. Keep the completed copy in
your controlled system. Share redacted facts when requesting help; leave out
passwords, API tokens, gateway recovery keys, customer records and report files.
This is a planning checklist, not an exposure scan or remediation certificate.

1. Ownership and reporting need
Report / semantic model:
Business decision and deadline, including time zone:
Reporting owner:
Source application:
Hosting / runtime owner:
Gateway, connector or server-side intermediary:
PHP component confirmed by its owner, or still unknown:

2. Runtime confirmation (hosting owner)
Advisories: CVE-2026-109618 and CVE-2026-109619
Deployed PHP branch, package and web-serving interface:
Vendor's confirmation that BOTH CVEs are fixed, including any backport reference:
Patch date and any required worker restart completed:
Application compatibility checks / owner:
Suspected compromise: hosting security or incident-response escalation reference:

Upstream fixes: 8.2.35, 8.3.36, 8.4.27, 8.5.12, or a later maintained release on
the relevant branch. Distribution/LTS packages can carry backported fixes with
older-looking versions. Obtain vendor confirmation. PHP 8.1 and older lack
routine upstream security support. Follow the current official advisory:
https://www.php.net/archive/2026.php#2026-10-21-5
Temporary mitigations are incomplete; the full runtime patch is the target.
UK NCSC guidance, including offline and incident-response considerations:
https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php

3. Preserve and define the comparison
Last validated report/extract and timestamp:
Source period, time zone, currency, filters and refund/tax basis:
Expected unique record count:
Expected independently checked total:
Control period expected to remain unchanged:
Permitted test environment and fictional test record:

4. Record observed results AFTER runtime remediation
Response is expected JSON/CSV, not a login/error page:
Field names and data types:
Source latest business timestamp:
Extract timestamp / row count / duplicate or missing keys:
Published model refresh result and completion time:
Report's unique record count and agreed measure:
Source-to-extract-to-report differences explained:
Authorised test record visible once, with the expected value:
Repeated feed read retains the expected count/total:
Unchanged control period confirmed:
Outstanding exceptions and named reviewer:

Illustrative specification only, not executed platform evidence:
100 unique orders and GBP 12,500 remain 100 and GBP 12,500 after patching.
An authorised test order of GBP 250 gives 101 orders and GBP 12,750.
Repeat reading preserves 101 and GBP 12,750. Test on your connected systems.

5. Reporting handoff
Hosting owner confirms runtime remediation:
Reporting owner records acceptance or outstanding exceptions:
Next refresh to observe:
Urgent reporting-feed enquiry (redacted facts only):
https://turingbi.com/contact?enquiry=php2shell-power-bi-data-feed-checks#enquiry