Dear customers,
Please note that two PHP security vulnerabilities, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), have recently been disclosed. You may find more information about the vulnerability at https://www.php.net/archive/2026.php#2026-10-20-1
Affected Services: Websites and applications running PHP (all versions) on all platforms.
Current Status:
- Mitigation measures have been implemented across all our platforms to reduce the risk of exploitation.
- An official fix from the PHP project has not yet been released.
- Once the official fix becomes available, we will apply it across our platform.
In the meantime, customers are advised to keep their CMS, themes, plugins, and other applications up to date and regularly monitor their websites for any unusual activity.
Thank you for your patience and understanding. We will update this status post as soon as more information becomes available.
Update @ 09:40 AM EDT | 01:40 UTC:
The php.net team has released the updated versions. Our team is installing them across our platform. We’ll update you once it’s done. If you manage your VPS or dedicated server, please update PHP now to the fixed version.