PHP2Shell – anatomy of a 2 weeks old crisis, and the playbook for the next one

A vendor-agnostic look at PHP2Shell (CVE-2026-109618/109619), from early leak to patch to in-the-wild exploitation. We'll cover why it bypasses application-layer defences, why old PHP versions with no official fix leave public-sector and smart-city estates exposed, and why leaked memory means rotating credentials is part of the response, not an afterthought. Attendees leave with a practical playbook: asset discovery, prioritising unsupported versions, rotating secrets, and deciding what to do when a disclosure comes out before the fix.