PHP2Shell: Important security notice for your PHP websites

What happened?

On October 21, 2026, the PHP team released security updates for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619, commonly called PHP2Shell. Under certain conditions, unauthenticated attackers can execute code with the permissions of the web server process.

What should you do now?

• Update PHP: Fixes are included in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Use at least the fixed release of your branch, or a package confirmed as patched by your operating system vendor. Vendors may backport fixes without changing the upstream version number, so check their security advisory.
• Restart all PHP workers: After updating, ensure that no processes continue running the old PHP code. Check each website, PHP version and container separately.
• Keep applications updated: Update your CMS, plugins and themes as well. Updating your CMS alone does not replace the PHP security update.

What does this mean for your Key2Host service?

Your own cloud server: If you operate PHP yourself, check and update your installation, including custom containers. Back up your data before making changes and test your website afterwards.

Web hosting: If you cannot determine whether your PHP installation is patched, contact us through the Helpcenter. Include your domain and PHP version. This notice does not confirm an individual service's patch status or a security incident.

Additional notice from October 23

PHP temporarily recommends setting session.upload_progress.enabled=0 until a further fix is released through the regular release cycle. This additional notice concerns a specific configuration scenario and does not replace the updates above. Review configuration changes with your administrator.

Information current as of October 24, 2026.

Official sources

• PHP: Security updates and additional notice
• CVE-2026-109618: PHP security advisory
• CVE-2026-109619: PHP security advisory