Fixing PHP2Shell by Volker Dusch

Hello Symfony Community!

We are thrilled to announce the next user group meeting, featuring an insightful talk that you won't want to miss!

Come by and enjoy an evening of learning, networking, and socializing with fellow Symfony and PHP developers.

Agenda:
18:30: Doors open
19:00: Welcome and Introduction
19:20: Talk: "Fixing PHP2Shell" by Volker Dusch
20:00: Snack & Socializing

"Fixing PHP2Shell" by Volker Dusch
In October, PHP2Shell (CVE-2026-109618 / CVE-2026-109619) made headlines worldwide. It happened before any application code ran, and it affected every PHP version back to 5.4.

Volker Dusch, PHP 8.5 release manager and AI Security Engineer in Residence at the PHP Foundation, worked with the PHP security team on the fix. He takes us from an urgent email with a working exploit in a Docker container to a release day that went anything but according to plan.

How did researchers find a bug that had been hiding in PHP’s out-of-memory handling for more than a decade? Why does fixing it mean hunting down every single place the pattern occurs, and why does a fix in php-src take so long to reach your server? And what happens when CVE IDs leak early, an exploit video goes online by accident, and patched images ship hours before the embargo lifts?

Don't miss this insightful talk, engaging discussions, and networking opportunities. We can't wait to see you all at the Symfony User Group of November.
If you have any questions or accessibility requirements, please reach out to us.