# CHANGELOG · php2shell service page pack

## 2026-10-22, ~3:00 PM PT (Grok Bot, hand-off edit only; nothing built or deployed)

**Correction: PHP 8.1, 8.0 and 7.4 do get an official fix.**
The first draft (7:45 AM PT) said "8.1 and older get no fix from php.net". That was wrong. The PHP security team published official source-only "minimal mitigation" patches for the end-of-life 8.1, 8.0 and 7.4 branches. CloudLinux alt-php, Plesk, Ondřej Surý's packages (sury), Remi, cPanel EasyApache and Zend LTS ship them. The version number does not change (`php -v` still says 8.1.34, 8.0.30 or 7.4.33), so the check is the package build date: Oct 21, 2026 or later. PHP 7.3 and older have no official patch.

Sources checked Oct 22 PM: Plesk KB (EOL builds "built on 21 Oct 2026"), CloudLinux alt-php81 changelog (8.1.34-39, 21.10.2026, "Upstream 1d7dec17"), cPanel EA4 table (ea-php81 8.1.34-5, ea-php80 8.0.30-12, ea-php74 7.4.33-19), ma.ttias.be patch tracker, Sophos advisory ("source-only backports for 7.4, 8.0 and 8.1").

Edited:
- `PAGE-COPY.md`: version table (8.1/8.0/7.4 row + new 7.3-and-older row); "Who is at risk" bullet; Check-yourself step 4 (build date); tier 4 renamed "PHP 8.1 or older: patch now, then upgrade or move" with a new first bullet; CISA line scoped to versions with no patched build; FAQs "Which PHP versions fix...", "My PHP version number didn't change...", "PHP 8.1 end of life...", "Do I need to take my site offline?"; sources block (+ Plesk, CloudLinux, tracker, Sophos).
- `KEYWORDS.md`: H3 outline, Offer name, Service description, matching FAQPage JSON-LD answers, three new keyword rows.
- `AEO-SNIPPETS.md`: snippets 3, 6, 9 rewritten; word counts re-checked (all 40 to 60).
- `README.md`: correction banner, tier name, fact F3 rewritten, new facts F17 to F20, new Critic check line.

**Also changed (same pass):**
- Score FAQ and AEO 10 now say NVD lists 9.8 (CVSS v3.1) next to PHP's 9.2 (CVSS v4). Fact F18.
- Firewall FAQ and AEO 14 now say a WordPress plugin firewall such as Wordfence can't stop these flaws. Fact F17.
- "After any tier" line now points to the new security subscriptions (`../security-subscriptions/`), not care plans. Care plans host static sites with no PHP, so they aren't where WordPress patching lives.
- KEV re-checked 2:43 PM PT Oct 22: still not listed (F20).
- Logged, not added to page copy: Sophos retracted its "one successful exploitation" claim at 2:21 PM PT Oct 22 (F19). Don't write "Sophos confirmed an exploit" anywhere.

Backup of the pre-edit files: `/workspace/php2shell-service-page.bak-2026-10-22/`.
Critic: re-run the FAQ-vs-JSON-LD word-for-word check, since six answers changed.

- ~2:52 PM PT: added the Sophos research blog link (home of the Oct 22 correction) to PAGE-COPY sources, next to the advisory link. Both links verified loading.

## 2026-10-22, ~3:10 PM PT: Critic FIX round 1 (`../_critic/CRITIC-security-subs-php2shell-2026-10-22.md`)
Backup before edits: `/workspace/php2shell-service-page.bak-2026-10-22-precritic/`.

8. FAQ "Is my WordPress site affected..." and "Is the CVE-2026-109618 patch out?": added the 8.1/8.0/7.4 build-date line (Oct 21, 2026 or later) in PAGE-COPY and the FAQPage JSON-LD in KEYWORDS.md. AEO snippet 2 updated to match (57 words); snippet 6 already had it.
9. FAQ "Do I need to take my site offline?": now "CISA's Oct 21 alert, which doesn't mention the official 8.1, 8.0 and 7.4 patches, advises...". Wording chosen because I re-read the CISA alert at ~3:05 PM PT and it lists only 8.5.12/8.4.27/8.3.36/8.2.35 and says "PHP 8.1 or earlier"; I could not confirm the alert's publish time relative to the backports, so the copy doesn't say "before". NSA/FBI mention dropped from this answer. Same change in JSON-LD, AEO 13 and README F6.
10. s6 step 6: "keep us on a care plan" → "keep us on a security plan".
11. Tier name: "patch now, then upgrade or move" → "patch, then upgrade or move" in PAGE-COPY, KEYWORDS (H3 outline and JSON-LD Offer) and README.
12. Firewall FAQ: removed "Wordfence says updating and restarting PHP is essential" (secondhand). The answer still says a plugin firewall such as Wordfence runs inside WordPress, so it can't stop these flaws. README F17 notes paraphrase only.
13. Optional checklist price "{PROPOSED ~$9, json to set}" → "{DECISION, json to set}" in PAGE-COPY and README decision 4.

Parity: `python3 /workspace/faq_parity.py PAGE-COPY.md KEYWORDS.md` → 19 visible, 19 JSON-LD, 0 mismatches (links reduced to anchor text, crew notes excluded). AEO word counts rechecked: all labels match, all 49 to 57 words.

## 2026-10-22, ~3:00 PM PT: Critic follow-up (non-blocking, after PASS)
- AEO-SNIPPETS 5 (fix, body line 24) and 7 (verify, body line 30) now add the 8.1/8.0/7.4 line: patched builds dated Oct 21, 2026 or later. Matches the FAQ. Word counts relabeled (5: 58, 7: 58); all 18 snippets are 49 to 58 words and every label matches its count. Snippet 7 also lost "yourself" and "after the update" to stay under 60.