PHP has been updated on shared hosting servers to fix two critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 (nicknamed PHP2Shell by researchers). On October 21, 2026, the PHP team released emergency patches, and the update was applied on our servers the same day.
Both vulnerabilities were rated 9.2 out of 10 on the CVSS v4.0 scale and, under certain conditions, allow unauthenticated remote code execution on the server — meaning an attacker needs neither a password nor an account on the site.
Table of Contents
What makes CVE-2026-109618 and CVE-2026-109619 dangerous?
Both flaws live in the PHP core itself, not in any specific site’s code or plugin. That means sites on WordPress, WooCommerce, OpenCart, Joomla, Magento and any other CMS were at risk — even with fully updated, vulnerability-free application code.
CVE-2026-109618 — memory corruption during out-of-memory handling. When PHP is interrupted while internal request data is only partially initialized, the cleanup routine can treat that inconsistent data as valid. Some reports indicate this flaw could also leak fragments of server memory (similar to the well-known Heartbleed bug) — in theory exposing passwords, session tokens or other data from earlier requests handled by the same worker.
CVE-2026-109619 — a use-after-free vulnerability. Internal state tied to a request could outlive its own freed memory, and a later request handled by the same PHP worker could access that stale data before normal initialization reset it.
All common PHP execution modes are affected: PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP.
Which PHP versions are fixed
On October 21, 2026 at 14:00 UTC, PHP released official fixed versions:
| PHP branch | Patched version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
What we did
We updated PHP on all shared hosting servers to the patched versions right after the official releases went live. Shared hosting customers don’t need to take any additional action — protection against CVE-2026-109618 and CVE-2026-109619 at the server environment level is already in place.
Frequently asked questions
Did the update affect site uptime? The PHP update on shared hosting servers was carried out as routine maintenance, with no noticeable downtime for customer sites.
Do I need to update plugins or my CMS separately? These vulnerabilities affect PHP itself, not any CMS. That said, we still recommend keeping your CMS, themes and plugins up to date and backing up your site regularly.
We continue to monitor PHP and other server software for security updates and apply critical patches across all shared hosting servers promptly.