Ankündigungen
- Mittwoch, 21. Oktober, 2026
- 22:32p. m.
[security Advisory] Critical PHP Remote Code Execution Vulnerabilities ("php2shell") — All Our Systems Have Been Patched
Dear customers,
PHP released an emergency security update on October 21, 2026, fixing two unauthenticated remote code execution vulnerabilities (CVSS 9.2):
- CVE-2026-109618: Attackers can send a crafted multipart POST request to exhaust memory and trigger an OOM (out-of-memory) condition. During request shutdown, this leads to memory corruption, allowing arbitrary code execution under the web process user.
- CVE-2026-109619: PHP worker processes keep unreset global state between requests. By crafting a heap layout across two requests handled by the same worker, attackers can trigger an unauthenticated use-after-free (UAF) and remote code execution.
Affected versions: PHP 8.2 < 8.2.35, 8.3 < 8.3.36, 8.4 < 8.4.27, 8.5 < 8.5.12 — all earlier 8.x releases are affected.
What we have done:
- ✅ All managed hosting accounts have been manually upgraded and patched
- ✅ All dedicated servers and non-self-hosted environments have been fully updated
- ✅ If your site runs on our managed hosting, no action is required on your side — you are already protected
What you need to do yourself:
If you use a VPS or self-hosted environment and manage your own PHP installation, please upgrade as soon as possible to one of these patched versions: PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or later. Please back up your data before upgrading.
Everyday security reminders:
- Keep your CMS, plugins, and PHP environment up to date
- Use strong passwords and enable two-factor authentication
- Follow the principle of least privilege and back up your data regularly
- Contact our support team immediately if you notice anything unusual
If you have any questions, feel free to reach out.