If you do not patch live machines, the PHP2Shell fix is a new image, AMI, or container, rolled through the fleet.
Identify the runtime
Find the bake pipeline and the package snapshot it uses. A pipeline that ran on 20 October 2026 will keep baking vulnerable PHP until its inputs change.
Change and verify
Update the snapshot, bake, and replace instances. Drain connections if the load balancer supports it. Keep one previous image for rollback. Validate a canary instance’s PHP package before you raise the new image to 100 percent.
Treat a green health check as proof the process listens. Prove the PHP build separately with the package query or the binary version from inside the new instance. Legacy applications that cannot move off PHP 5.6 or 7.x still need a decision recorded in the pipeline, or the next bake will quietly keep the vulnerable base.
Questions
Does the cloud provider patch PHP inside my image?
Only if that provider manages the runtime. Your image, VM package, or platform stack is the thing to verify.