Contents
On 21 October 2026 the PHP team released emergency updates for two critical vulnerabilities known as PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on the CVSS v4.0 scale and can lead to remote code execution through ordinary web requests, without any authentication.
What happened?
The first flaw is in how PHP handles an out-of-memory condition while preparing request data. The second comes from request state that is kept after its memory has been freed. A successful attacker can run code with the privileges of the web server user, and memory disclosure can expose passwords, tokens and API keys. Security researchers have demonstrated exploitation against WordPress, Drupal and Joomla.
Who is affected?
Every installation where PHP serves web requests is at risk: Apache mod_php, PHP-FPM, php-cgi and LiteSpeed. Because the flaw is in PHP itself and not in application code, keeping your plugins and themes up to date is not enough on its own. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are no longer officially supported.
What it means for Fiberserver customers
PHP updates have been applied on Fiberserver hosting servers. On shared hosting and cPanel accounts there is nothing further for you to do, but make sure the PHP version you select is a current branch. If you run a VDS or dedicated server, PHP on that machine is yours to manage, so the update is up to you.
What should you do?
- Check your PHP version and move to one of the fixed releases above.
- Restart PHP-FPM and the web server after updating.
- If you cannot update right away, set
session.upload_progress.enabled = Offas a temporary measure; it is not a complete fix. - Look for suspicious shells,
curlorwgetprocesses started by the web process on your server.
For step-by-step commands, details for different operating systems and control panels, signs of compromise and a checklist, read the PHP2Shell PHP update guide. If you would rather not manage a server yourself, updates on our cPanel web hosting plans are handled by us.