Critical PHP security vulnerability PHP2Shell: What web hosting customers need to know now

PHP2Shell: Two critical security vulnerabilities discovered in PHP

Under the name PHP2Shell, two critical security vulnerabilities in the widely used programming language PHP have come to light. They are listed under the identifiers CVE-2026-109618 and CVE-2026-109619 and are each rated with a CVSS-v4 score of 9.2.

Under certain conditions, attackers can exploit the flaws for Remote Code Execution (RCE). This could allow them to execute their own code on an affected server without needing to log in beforehand. Depending on the privileges of the PHP process, sensitive data could be read, websites altered or further attacks prepared.

The causes lie in PHP's internal memory management: for CVE-2026-109618 the handling of a memory error can lead to erroneous states during the cleanup of a request. CVE-2026-109619 concerns global state that may point to request memory that has already been freed. The problem therefore lies in PHP itself and not in the code of any single content management system.

Consequently, PHP-based web applications such as WordPress, Joomla, Drupal and online stores may be affected. The PHP developers name PHP-FPM, Apache with mod_php, PHP-CGI, FrankenPHP and LiteSpeed as relevant modes of operation. They rate the risk for mod_php as particularly high, because an attack can be triggered before application code is executed.

Which PHP versions are affected?

The official PHP project released security updates for the currently supported branches on 21 October 2026.

For older PHP versions the situation is more demanding. An old version number does not automatically mean a server is unprotected: Linux distributions, LTS providers and hosting companies can provide targeted security fixes as backports without changing the major version number. Some hosting companies offer this as part of a PHP Extended Support.

What therefore matters is not only the displayed version number. Operators should check whether an effective update or a confirmed backport exists for the specific PHP installation in use and whether it is already active.

Who is responsible for PHP security updates?

In classic shared web hosting the provider usually administers the operating system, web server and PHP. Security updates for the PHP runtime therefore normally fall within their area of responsibility. Customers should check the patch status and, if necessary, select a secured PHP version in the hosting panel.

With Managed WordPress and Managed Servers the provider takes on additional maintenance tasks. How far these extend is determined by the specific plan. While the PHP runtime environment is typically maintained by the provider, updates for WordPress, plugins, themes or custom-installed software may still be the customer’s responsibility.

With unmanaged VPS, Virtual Private Servers and Dedicated Servers the host primarily provides the infrastructure. The operating system, PHP and web server usually need to be updated there by the customer or their administrator. This also applies when Plesk or cPanel make the work easier: the update functions still need to be configured and controlled by the customer in an unmanaged plan.

This overview describes the typical responsibilities. The services agreed in the contract for the respective hosting plan always take precedence.

How are web hosting providers responding to PHP2Shell?

Implementation varies by provider, product and PHP version in use. Website operators should therefore always check the status update for their own plan.

IONOS: Security maintenance underway

IONOS notes security maintenance on its status page. According to the company, affected services are being restored; during this process websites may be temporarily less accessible or respond more slowly. For self-managed VPS and bare-metal servers customers must apply the necessary updates themselves.

Hetzner: Updates also for several older release branches

Hetzner reported on its status page that PHP 7.4 as well as PHP 8.0 to 8.5 on web hosting and managed servers were updated to patched versions. For even older PHP versions the company is continuing to work on backports. This demonstrates that release branches no longer regularly supported can also be secured through provider maintenance.

Alfahosting: Check status and hosting plan

Alfahosting also reports on the security vulnerabilities on its status page. For web hosting customers the provider can manage the PHP environment; for self‑managed VPS hosting and Dedicated Servers operators should promptly check the patch status of their systems themselves and install the available updates.

What should website operators do now?

Which measures are necessary depends on the hosting model and the actual patch status. For publicly accessible systems the check should be prioritised.

1. Clarify the hosting model: Check whether the website runs on shared hosting, a Managed offering or a self‑managed server.
2. Check PHP version and patch status: The version in use is often shown in the customer area. Our guide explains, how to determine the current PHP version. For old branches explicitly ask about a security backport.
3. Read the provider's status message: Progress is often communicated via status pages, customer notifications or support. If a clear confirmation is missing, contact customer service.
4. Update your own servers: Operators of unmanaged VPS hosting and Dedicated Servers should apply the security updates from the operating system or PHP vendor immediately, restart affected PHP and web server processes and check all PHP installations.
5. Check logs and backups: After the update check website functionality, backups and, if there are anomalies, server logs. A patch closes the vulnerability but does not remove any compromise that may already have occurred.

Temporary configuration measures can limit individual attack vectors, but do not replace an update. The PHP project explicitly states they are not a complete solution. If a publicly accessible system is demonstrably vulnerable and cannot be updated promptly, public access should be temporarily restricted or the application isolated.

Downtime may occur during maintenance. Regular HTTP monitoring can be used to monitor availability and response times. However, this does not replace a security update or a forensic investigation in the event of suspected compromise.

Is a WordPress update sufficient?

No. The vulnerabilities are in PHP, not in WordPress code. A fully updated WordPress installation is therefore not sufficiently protected while it is running on a vulnerable PHP runtime environment.

Regular updates of WordPress, themes and plugins remain essential because they close other security gaps. With traditional web hosting, customers normally do not need to change any PHP code: the hosting provider is usually responsible for updating the server environment.

Conclusion: How urgently do web hosting customers need to act?

PHP2Shell is a serious threat to PHP-based websites and applications. Patched PHP versions are available; affected systems should therefore be secured as quickly as possible.