When zero day security flaws hit core runtime environments, waiting for upstream patches leaves applications exposed. Updates to CMS platforms or plugins cannot fix flaws inside PHP itself.
Here is how we handled the PHP2Shell vulnerability to protect applications proactively:
- Applied WAF rules at the edge layer 22 hours before the upstream PHP fix was released
- Blocked malicious request patterns across all regions without altering application code
- Proactively patched and restarted affected sites, including legacy PHP versions no longer maintained upstream
- Isolated communication and engineering workflows to maintain status updates during active scanning
Read the full incident breakdown and technical rollout details:
How Upsun handled PHP2Shell: protection in place 22 hours before the patch | Upsun
On 21 October 2026, Upsun had WAF rules blocking PHP2Shell attacks before the official fix existed. Here’s the full timeline of how we protected every customer, including sites on unsupported PHP versions.
upsun.com 
