Php2Shell (CVE-2026-109618/CVE-2026-109619)

## Description

[CVE-2026-109618](https://www.cve.org/CVERecord?id=CVE-2026-109618) and [CVE-2026-109619](https://www.cve.org/CVERecord?id=CVE-2026-109619) are two critical vulnerabilities in PHP itself, known together as Php2Shell.
They let an attacker run code on your server with a crafted request, without logging in.
They affect every PHP version from 5.4 on, so Magento, Shopware, WordPress, and any other PHP site are exposed.
Attacks were already being reported on the day the fix was released.
Sansec has a [write-up](https://sansec.io/research/php2shell) with more details.

The PHP project fixed both in [PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12](https://www.php.net/ChangeLog-8.php), released on October 21, 2026.
PHP 7.4 and 8.1 no longer get releases from the PHP project, but the PHP packages AutoPilot uses ship the same fix backported to them.
This patch upgrades the PHP version your deployment uses to its fixed release.
Your deployment stays on the same PHP version, only its patch level changes, for example from 8.3.35 to 8.3.36.
On PHP 7.4 and 8.1 the version number stays the same and only the package build changes.

Before the fix was out, we applied an emergency hotfix to AutoPilot deployments that turns off PHP's session upload progress feature (`session.upload_progress.enabled = Off`), following [Sansec's temporary mitigation](https://sansec.io/research/php2shell#temporary-mitigation).
That reduces exposure, but it doesn't fully close the vulnerability, so upgrading PHP is still the only complete fix.
The hotfix setting stays in place after this patch.

!!!warning Warning
PHP 7.4 and 8.1 are end of life, and the fix for them is a minimal backport made for this emergency.
If your deployment runs one of those versions, we still recommend moving to a supported version, and support@jetrails.com can work with you on it.
!!!

## Impact

On a single node deployment, PHP-FPM restarts once to load the fixed version, which interrupts requests for a few seconds.
On a cluster, PHP-FPM restarts on the web leader, a backup of the web leader is taken, and the rest of your web nodes are replaced with it.
There will be some downtime while the new web nodes roll out.

## Changes

- Upgrades the PHP version your deployment uses to its fixed release on the jump node and the web leader.
- Keeps your PHP settings as they are.
- Restarts PHP-FPM on the web leader to load the fixed version.
- On clusters, backs up the web leader and replaces the rest of the web nodes with it.

## If You Accept

Your sites run on a PHP release that fixes CVE-2026-109618 and CVE-2026-109619, which closes the remote code execution path.
It's a patch release of the PHP version you already use, so your code and extensions don't need any changes.

## If You Reject

Your deployment stays on a PHP release that can be exploited without logging in.
An attacker who exploits it can run code on your server, which puts your site, your data, and your customers' data at risk.