GoKawiilColdFusion Hosts Find Leftover PHP Installs and Unneeded Mitigation Rules
A ColdFusion developer discovered that a hosting provider's server-wide IIS rewrite rule, deployed after PHP's October 21, 2026 emergency patches for a critical flaw dubbed PHP2Shell, was blocking legitimate multipart form-data requests on sites that don't even run PHP. The piece walks through using PowerShell to detect whether PHP is installed on a Windows/IIS ColdFusion or Lucee server—often left over from control panels or old phpMyAdmin installs—and how to remove it if unused.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident suggests hosting providers sometimes apply broad, server-wide security mitigations that can break unrelated applications, rather than targeting only the vulnerable software—an approach the author notes goes beyond PHP's own official guidance of patching and adjusting specific settings. It also highlights that unused PHP installations can linger silently on servers running entirely different stacks, creating both unnecessary attack surface and confusing side effects when unrelated patches are applied.
- PHP released emergency patches on October 21, 2026 for two critical unauthenticated remote code execution flaws nicknamed PHP2Shell.
- A hosting provider's server-wide IIS rewrite rule blocking multipart form-data requests inadvertently affected non-PHP ColdFusion/Lucee sites.
- The author provides a PowerShell-based method to detect and remove orphaned PHP installations on Windows/IIS servers.
Source: gregoryalexander.com, 2026-10-26
Published there as: “Is PHP Running on Your ColdFusion Server? How to Check, and Remove It”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.