Skip to content

DDEV October 2026: PHP2Shell Fixed in v1.25.5, Thanks to Ondřej Surý and the PHP Foundation

Newsletters
Randy Fay avatar
Randy Fay

October 27, 2026 7 min read

Edit this page
Nancy Lewis: Spring Along the Colorado River, watercolor painting of the river winding past green trees below red canyon cliffs

PHP2Shell, and DDEV v1.25.5

On October 21, PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell”. A single unauthenticated request could run code on any server running PHP. PHP’s security advisory↗ has the details.

Local DDEV projects listen only on your own computer, so nobody on the internet could reach them. Projects exposed with ddev share or used for casual hosting↗ were at risk, and so were your production servers. Stas wrote up the same day what DDEV users needed to do, including how to get the fixed PHP into projects before a new DDEV release: PHP2Shell: What DDEV Users Need to Know.

DDEV v1.25.5 shipped on October 26 with the fixed PHP in ddev-webserver. PHP 8.1 and older are past end of life and get no fixes from PHP, but deb.sury.org patched every version it ships, so PHP 5.6 through 8.1 in DDEV are fixed too. Upgrade, run ddev restart, and check ddev php -v. If you haven’t updated PHP on the servers where your sites are hosted, do that first.

v1.25.5 also brings 142 community PRs that were waiting for the next release:

  • A rebuilt ddev tui that fits any window and shows database addresses, snapshots, ports, and add-on updates
  • ddev config global --ssh-agent-upstream=host, so containers use the SSH agent you already run (macOS agent, 1Password, Secretive, YubiKey)
  • ddev restart -s <service> to recreate only the services you name
  • QR codes from ddev share and ddev launch --qr, replacing the ddev-qr add-on
  • zstd for ddev import-db, ddev export-db, and ddev import-files
  • Global hooks, and global_config.*.yaml files merged over global_config.yaml
  • Initial PHP 8.6 support (RC3, which doesn’t have the PHP2Shell fixes yet)

The release post covers these and the changes that might affect you.

Standing on the Shoulders of Giants

DDEV couldn’t have shipped a PHP fix this way on its own. It has always depended on two upstreams that most PHP developers rely on without thinking about them.

Ondřej Surý has packaged PHP for Debian since PHP 5, and maintains deb.sury.org↗, the repository that ddev-webserver, the ondrej/php PPA, and a large part of the PHP world install from. On the day of the PHP release, he published fixed AMD64 packages for every PHP version back to 5.6, including versions PHP itself no longer supports. As he writes on his site, “The PHP packaging is time consuming and I do this mostly in my free time.” The BBC told his story in How one man became the unsung hero of the internet during a cyber-security scramble↗. His day job is director of DNS engineering at ISC↗, the nonprofit behind the BIND DNS server, and when the PHP2Shell details leaked early he had less time than planned to build the packages: “The feeling is like I am responsible for all these people and I can’t fail them.” Donations that week passed $10,000, which he said was “basically about a year’s worth of the contributions that I got before.” His message to the companies that depend on his packages: “If you just take and don’t give back then it will backfire.”

The PHP Foundation leads development and maintenance of PHP itself, including the security work behind releases like this one. The team is small for a language that runs so much of the web. “We have one full-time staff member (that’s me) and 14 mostly part-time contractors,” Executive Director Elizabeth Barron told CNA↗ after the release, adding that “it is clear that PHP is incredibly under-funded.” In 2025 its developers made 2,929 commits across 9 PHP repositories and reviewed 1,685 community PRs in php-src (2025 impact report↗). On release day it also published Today’s PHP Security Release, and How We’re Strengthening PHP Security↗.

The DDEV Foundation has sponsored both for years, because DDEV is built on their work. If PHP is part of how you make a living, please support them too:

Community Projects

DDrovr: a native macOS app for DDEV — A SwiftUI desktop interface from Bison Digital for projects, logs, databases, Git, and settings, with start and stop from the menu bar. It runs the DDEV CLI and reads .ddev/ rather than replacing anything. Version 1.0.3 needs macOS 14 and DDEV v1.24 or later. ddrovr.com↗

ddev-openlitespeed — An add-on from morvy that replaces DDEV’s web server with OpenLiteSpeed running lsphp, for PHP 5.6 through 8.5. It honors .htaccess and works with the LiteSpeed Cache WordPress plugin. Install with ddev add-on get morvy/ddev-openlitespeed. GitHub↗

ddev-clim — A small terminal UI from lemachinarbo for starting and stopping DDEV projects, which can also restore your running projects at boot, with a systemd user service on Linux. Available from the AUR. GitHub↗

Mage 3.0 detects DDEV — Sean van Zuidam’s CLI for Magento 2 and Mage-OS now detects DDEV and runs its commands inside the container, so mage cache:clean works without ddev exec. Release post↗

Talks and Tutorials from Around the Web

  • What’s New in DDEV for TYPO3 Folks, October 2026 → Snapshots and seeded databases, Branchery, TYPO3 Quickstarter, Knecht, and PHP2Shell, for TYPO3 developers. Read on news.typo3.com↗
  • René Kreijveld at Joomla World Conference → Joomla development with DDEV. View the slides↗
  • DDEV for Drupal: setup, import, and export → Nadeem Mir of Dynamosys on setting up a Drupal 11 project, importing a site’s database and files, and exporting it again, with warnings about what ddev import-db and ddev import-files overwrite. Read on dynamosys.com↗
  • Migrating a 13-year-old WordPress blog to Drupal CMS → Christian López Espínola (penyaskito) moved a 722-post blog to Drupal CMS 2.2. The WordPress clone ran as its own DDEV project, and the Drupal project read its database container directly with wordpress_migrate_sql across 24 migrations. Read on penyaskito.com↗
  • Import a WordPress site with BackWPup → Matthias Andrasch shows how to pull a BackWPup backup into DDEV with a custom provider and ddev pull backup. It’s from 2023, so adjust the versions in the example config. Read on dev.to↗

DDEV Live Training

All sessions are open to everybody.

Shopware with DDEV, with Benny Poensgen — The October 21 session is recorded. Watch the recording↗, browse the slides↗, or read Benny’s Shopware on DDEV post.

Hobobiker Rides Again, at the Drupal AI Learners Club — Randy, Amber Matz, and Angie Byron are migrating hobobiker.com, a Drupal 6 site from 2009, with Claude, live and in three parts. Everything runs in DDEV, and the repository, a sanitized database, and the slides are linked from the hobobiker.com README↗.

  • Part 1, Road Test (October 16) → Before migrating anything, Claude wrote a Playwright test suite against the old site. Working from the raw Drupal 6 database, it found the content types on its own, knew to use only the latest node revisions, and flagged problems nobody asked about, including database backups that anyone could download. Watch the recording↗ or read the club’s recap↗.
  • Part 2, The Last Ride (October 23) → Claude retired the site as static HTML, following Lullabot’s “Sending a Drupal Site into Retirement” and checked against the tests from Part 1. The archive is now live at static.hobobiker.com↗. Watch the recording↗ or read the club’s recap↗.
  • Part 3, The Long Haul (Friday, October 30 at 10:30 AM US Mountain / 12:30 PM US Eastern / 17:30 CET) → Drupal 6 to Drupal 11. Claude explores the source and the destination and writes a migration plan before touching any code, and the finished site has to pass the same test suite. Register on Luma↗

The next DDEV training session:

  • November 11, 2026 at 8:00 AM US Mountain / 10:00 AM US Eastern / 16:00 CET — Advanced Coder.ddev.com Techniques
    Using the coder CLI, local and web-based VS Code, and remote-controlling Claude, including the freeform template.
    Add to Google Calendar • Download .ics

Zoom Join Info:
Link: Join Zoom Meeting
Passcode: 12345

Governance

  • The next DDEV advisory group meeting, open to everybody, is November 4, 2026 at 8:00 AM US Mountain / 10:00 AM US Eastern / 16:00 CET. Add to Google Calendar • See the agenda. We love to hear from our community!

Sponsorship Update

We so appreciate all of you supporting the project!

September 2026: ~$10,099/month (84.2% of goal)

October 2026: ~$10,239/month (85.3% of goal)

If DDEV has helped your team, consider sponsoring. → Become a sponsor↗

Contact us to discuss sponsorship options that work for your organization.

Stay in the Loop—Follow Us and Join the Conversation

Compiled and edited with assistance from Claude Code.