Security Advisory: Critical PHP Vulnerabilities ("PHP2Shell") — Update Now

On 21 October 2026 the PHP project released emergency security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (nicknamed “PHP2Shell”). Both are rated 9.2 (critical) and can let an attacker run their own code on a web server without logging in. Attempts to exploit them have already been reported.

Which PHP versions are safe?

• PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (or newer) contain the fix.
• Every earlier release is affected, and PHP 8.1 and older receive no fix at all. Sites on those versions must move to a supported version.

What we are doing

All of our shared and reseller hosting servers are already updated to the fixed PHP versions, so websites hosted with us are protected. This client portal does not run on PHP and is not affected.

What you should do

• Hosting with us: in cPanel → MultiPHP Manager (or Select PHP Version), make sure your websites use PHP 8.2 or newer. If a site still needs PHP 8.1 or older, open a ticket and we will help you upgrade it safely.
• Your own VPS or server: install the updated PHP packages now and restart PHP-FPM / your web server.
• Temporary measure only: setting session.upload_progress.enabled = Off blocks one way of attacking the second flaw, but it does not fix the first. Updating PHP is the only complete fix.
• Keep WordPress, plugins and themes up to date as well, and check your site for files you don't recognise.

Need a hand? Open a support ticket or message us on WhatsApp, and our team will check and update your site for you.

References: php.net changelog · Rapid7 analysis