PHP Security Vulnerability affecting Hosting Services
Dear customers, two PHP security vulnerabilities, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), have been disclosed, affecting PHP-based websites and applications.
The php.net team has released the updated versions. Our team is installing them across our platform. We'll update you once it's done. If you manage your VPS or dedicated server, please update PHP now to the fixed version. Also, you should keep your CMS, themes, plugins, and applications updated and monitor your websites for unusual activity.
While our team is proactively fixing the issue, we want to keep you updated and let you know that the fix was already deployed on all servers, except for the following ones:
Reseller: 48, 55
Regular: 71-72, 86, 105, 165, 310, 312, 320.
Once the fix is deployed for those servers as well, we will notify you as well via our status post for updates on the issue: https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/ .
