On 21 October 2026 the PHP project released fixes for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, now known as PHP2Shell. PHP is the language most websites run on, including WordPress. Under certain conditions the flaws let an attacker run their own code on a server without logging in, and security firms have reported attempts to exploit them.
What we have done
- Our shared hosting servers were updated to the fixed PHP versions on 22 October 2026, and PHP was restarted for every website so the fix is in use. This was completed by 12:40 SAST that day.
- Noiz < Nextcloud is running the fixed version.
- Servers we manage under a server support agreement have been updated.
What you need to do
- Shared hosting, email and Noiz < Nextcloud: nothing.
- Self-managed Cloud VPS, Custom VPS or dedicated server: you administer the server, so please update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or later), or to your distribution's patched build if you run an older version. Then restart PHP and your web server so your sites use the fix. If you still run PHP 8.1 or older, plan a move to a supported version.
- If you would like us to update your server for you, our Linux administration is available at R880 per half hour. Open a ticket or email [email protected].
PHP's security advisory: php.net/archive/2026.php
