Home > Announcements > Security Advisory: Critical PHP Vulnerabilities (PHP2Shell)
There are two recently reported critical security vulnerabilities in PHP, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619).
These vulnerabilities may allow attackers to run malicious code on vulnerable websites without logging in, potentially compromising website security and exposing sensitive information.
We are reviewing the affected PHP environments under our management and would like to share the following information and recommended actions to help customers protect their websites.
Who Is Affected?
The vulnerabilities affect PHP installations serving web requests, including websites running content management systems (CMSs) such as WordPress, Joomla, and Drupal, as well as e-commerce platforms and custom-built web applications.
Websites running vulnerable PHP versions may be at risk. Older versions, particularly PHP 5.x and PHP 7.x, require special attention because they no longer receive regular security updates from the PHP project.
Available Security Fixes
The official PHP releases containing fixes for these vulnerabilities are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Upgrading to a PHP version containing the official security fixes is the recommended complete remediation. The official PHP advisory also outlines temporary mitigation measures that may help reduce exposure if an upgrade is not immediately possible. However, these measures are not a permanent solution and should not be considered a substitute for applying the security fixes.
What Are We Doing?
As your hosting provider, we take the security and reliability of our hosting environment seriously.
Our technical team has applied the official security fixes for the reported PHP2Shell vulnerabilities to our PHP 8.2, 8.3, and 8.4 server environments. Websites running these PHP versions within our hosting environment are covered by these updates.
We understand that some websites rely on legacy applications, themes, plugins, or custom code that may not be compatible with newer PHP versions. Upgrading PHP without proper compatibility testing may cause website errors or service disruption. Therefore, we will not automatically upgrade the PHP version for websites currently running PHP 8.1 or older.
To help reduce exposure to these vulnerabilities, we have implemented the temporary mitigation measures recommended in the official PHP advisory for these older PHP environments, where applicable. However, these measures are not a long-term solution and do not replace upgrading to a PHP version containing the official security fixes.
We encourage customers running older PHP versions to prepare their websites for migration to a fixed PHP version. Once your website is ready, please contact our support team to arrange the PHP upgrade.
Recommended Actions for Customers
To help maintain your website’s security and compatibility, we recommend the following actions.
1. Review and Update Your Website
Check whether your website’s CMS, themes, plugins, and custom applications are up to date. Work with your website developer to identify and resolve compatibility issues and prepare your website to run on a supported PHP version.
2. Contact Us When Your Website is Ready for a PHP Upgrade
Once your website has been updated and tested for compatibility with a supported PHP version, please contact our support team to arrange the PHP version upgrade. Our team can assist with the PHP version change within the scope of your hosting service. We recommend performing appropriate compatibility checks before proceeding to minimise the risk of website errors or downtime.
3. Consider Temporarily Taking Your Website Offline
If your website relies on an outdated PHP version and cannot be upgraded or adequately protected with an available security fix, temporarily taking it offline may be the safer option until a suitable solution is available.
Please contact our support team to discuss the options for your hosting environment before taking action.
4. Consider Rebuilding Your Website
If your existing website relies on outdated technologies that are difficult to maintain or upgrade securely, rebuilding it may be a more sustainable long-term solution.
Our web design services can help you develop a modern website designed to work with a supported PHP version, making it easier to maintain compatibility and receive future security updates.
Please contact our team if you would like to discuss a website redesign or migration.
Our Commitment to Security
We remain committed to maintaining a secure and reliable hosting environment for our customers. We will continue monitoring official security advisories and implementing appropriate remediation measures within our hosting infrastructure.
If you are unsure which PHP version your website is using or need assistance assessing your options, please contact our support team.
For the latest technical information and security recommendations, visit the official PHP website.