On 21 October 2026, the PHP project disclosed two critical security vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 – also known in the security community as "PHP2Shell". Both have been rated critical with a CVSS score of 9.2. We want to be transparent with you about what this means and what we are doing about it.
Both flaws sit in the core of PHP itself – not in a single application, but in the programming language that a large share of all websites is built on, including WordPress, Joomla, Magento and many more. In the worst case, attackers can run their own code on a server via specially crafted requests, without logging in.
A flaw in the handling of out-of-memory situations can cause PHP to process half-initialised data during clean-up. Crafted requests can trigger this state deliberately.
Data from a previous request can remain in memory even though that memory has already been freed. A later request to the same PHP process can access it – with the risk of code being executed or memory contents being leaked.
All common PHP setups are affected, including PHP-FPM, Apache mod_php, CGI/FastCGI and LiteSpeed.
Immediately after the disclosure, our engineering team worked at full speed to install the security updates on all systems we manage.
Update of 22 October 2026: all systems managed by us are fully updated and patched. As a web hosting customer, you do not need to do anything further to fix the vulnerabilities.
Your websites, your data and your settings were not affected by the updates.
"The security of your websites and data is our highest priority. That is why we reacted immediately and protected all our systems without delay."
Our web hosting servers have already been updated. We nevertheless recommend checking in Plesk which PHP version your website uses: official fixes are available for PHP 8.2, 8.3, 8.4 and 8.5. For PHP 7.4 to 8.1 only limited fixes exist, and PHP 7.3 and older receive no fixes at all. Whenever possible, please switch your website to PHP 8.2 or newer.
Also keep your CMS (e.g. WordPress) as well as all themes and plugins up to date.
On your vServer with root access, you manage the installed software yourself. Please update PHP immediately to a fixed version – 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer – or install the security updates of your Linux distribution or control panel (e.g. Plesk). Afterwards, restart all PHP services (e.g. PHP-FPM) so that the fix takes effect.
Do you have questions about the vulnerabilities or your PHP version, or do you need help updating your vServer? Our support team is there for you via our ticket system. Thank you very much for your trust and understanding.