PHP Vulnerability Responses by Company

Opalstack LLC

Global hosting
Aliases / services
Opalstack / opalstack.com / Opalstack LLC
Official website
https://opalstack.com/
Sources identifying the operating company

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Opalstack-managed PHP applications

Response status
Provider patching completed
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

All managed PHP versions, including 5.x and 7.x, were reported patched by 21 October, 23:45 UTC.

Scope: Reversal of the temporary memory_limit setting was planned; completion was not found.

What users should do

Check application operation. Review the separate actions for private PHP configurations.

Official service URL

Source URLs

  1. PHP2Shell patches and custom PHP stackshttps://community.opalstack.com/d/1729-security-advisory-patches-for-php2shell-cve-2026-109618-cve-2026-109619Response evidence
  2. https://status.opalstack.com/incidents/249https://status.opalstack.com/incidents/249Response evidence
  3. https://status.opalstack.com/https://status.opalstack.com/Response evidence

Private PHP stacks on Opalstack

Response status
Customer restart required
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Private unmanaged PHP stacks require restarting to load patched PHP.

Scope: A restart alone is insufficient for custom builds.

What users should do

Restart the relevant PHP processes and verify application operation.

Source URLs

  1. PHP2Shell patches and custom PHP stackshttps://community.opalstack.com/d/1729-security-advisory-patches-for-php2shell-cve-2026-109618-cve-2026-109619Response evidence

Custom PHP builds on Opalstack

Response status
Rebuild from fixed source required
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Custom-built PHP must be rebuilt from source containing the fixes.

Scope: Server package updates do not establish that custom binaries are patched.

What users should do

Rebuild and deploy the fixed version, then verify running processes and applications.

Source URLs

  1. PHP2Shell patches and custom PHP stackshttps://community.opalstack.com/d/1729-security-advisory-patches-for-php2shell-cve-2026-109618-cve-2026-109619Response evidence
Related official sources
  1. PHP2Shell patches and custom PHP stacksOfficial noticeOfficial guidance on this vulnerability and the scope of the response.

Comments