PHP2Shell: a client-proof patch checklist for freelancers (CVE-2026-109618 / 109619)

How to check that a client's PHP really has the 21 Oct 2026 fix, what to look for since 17 Oct, and what to tell the client. Sources: CISA, Tenable, Amazon, Hostinger, php.net.