Magento 2 & Hyvä articles tagged “PHP-FPM”: hands-on tutorials, fixes, and guides from Kishan Savaliya, an Adobe-certified Magento developer.
4 articles
The October 2026 PHP security update fixes php2shell, two critical bugs that can allow unauthenticated remote code execution. Here is what they are, who is at risk, how to update on common setups, and what to do on PHP 8.1 and older.
My CloudPanel VPS had ten PHP-FPM versions running, six of them end of life. With the php2shell bugs out, here is how I proved none of them served a request, switched them off with systemctl, and kept a one-line rollback, plus what to do if a Magento store still needs old PHP.
php -v shows one PHP, but most servers run several at once: CLI, a PHP-FPM service per version, Docker containers and control panel builds. Here is how I found all of them on my own VPS before the 21 October 2026 PHP security release.
Most Magento TTFB advice stops at "enable Varnish". After dragging one Magento 2.4.9 store from 1.8 s down to 180 ms, three fixes mattered: PHP-FPM pm.max_children sized to actual per-process memory, a Redis cache_id_prefix collision that two stores quietly shared, and Varnish ESI scoped to cart and wishlist blocks. Here is the real var/log/php-fpm.log, redis-cli MONITOR output, and varnishlog trace that pinned each one: with a table that separates what hits TTFB from what only hits LCP and INP.
