The PHP development team issued emergency security releases on 21 October 2026 to resolve two critical vulnerabilities collectively referred to as PHP2Shell.
Tracked as CVE-2026-109618 and CVE-2026-109619, these vulnerabilities could enable attackers to run malicious code remotely on affected servers.
Security updates are now available from both cPanel and Plesk, including fixes for certain older PHP releases. CloudLinux has also supplied backported patches for older versions through its supported PHP packages.
At Webhosting UK, we have been monitoring developments, introducing additional security measures before the official patches became available and overseeing the deployment of updates throughout our hosting infrastructure.
Whether you need to take action depends on your service: Shared Hosting, a Managed VPS, Cloud or Dedicated Server, or a self-managed server.
Understanding PHP2Shell
PHP2Shell is the collective name for two critical flaws in PHP, the programming language behind millions of websites, including WordPress and many other widely used applications.
An attacker could potentially exploit these vulnerabilities to execute malicious code on an affected server without supplying valid login credentials.
On 21 October 2026, the PHP development team released these patched versions:
- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12
Software vendors have also provided security fixes for older PHP releases.
The identification of these flaws does not, by itself, indicate that your website has been compromised. Nevertheless, their potential impact is significant, and installing the relevant security updates should be prioritised.
You can find further details on the official PHP website.
Our response for Shared Hosting customers
Webhosting UK is responsible for the underlying Shared Hosting infrastructure, including security updates at server level.
Our shared hosting platform is protected by our own Web Application Firewall (WAF).
After the vulnerabilities were announced, we introduced security rules intended to mitigate potential attacks as soon as those rules became available. We also put additional mitigation measures in place to strengthen protection.
Now that the relevant vendors have released patches, we are actively tracking the automatic update rollout across our shared hosting infrastructure to ensure the required fixes are applied.
Is any action needed from Shared Hosting customers?
Shared Hosting customers do not need to take any action regarding these server-level security updates. Our technical team is handling the patches and associated security measures for you.
Our response for Managed VPS, Cloud and Dedicated Servers
For our Managed VPS, Cloud and Dedicated Server customers, we proactively deployed the recommended security mitigations across our managed server estate where appropriate, ahead of the official patches, to reduce exposure to these vulnerabilities.
cPanel and Plesk have since released the relevant security updates, while CloudLinux has made patched packages available for older PHP versions.
Automatic updates for control panels and PHP security fixes are enabled as standard on our Managed VPS, Cloud and Dedicated Servers, unless customers have modified or disabled those settings.
We are actively tracking patch deployment throughout our managed server estate to check that updates are applied successfully.
Updates from cPanel & WHM
cPanel has published security fixes for both its EasyApache PHP packages and cPanel & WHM software.
The releases address currently supported PHP versions and provide backported fixes for older branches, including PHP 7.4, 8.0 and 8.1.
Provided automatic updates are enabled and the installed packages are supported, these fixes should be delivered through the usual update process.
Updates from Plesk
Plesk has issued security fixes for the PHP versions used by hosted websites.
These cover supported PHP packages on Linux and Windows. Backported fixes are also available for certain older Linux versions, including PHP 7.4, 8.0 and 8.1.
Separate updates have been released for the PHP component that Plesk uses internally.
As with cPanel, supported packages should receive the patches through the normal update mechanisms where automatic updates are enabled.
Updates for CloudLinux servers
CloudLinux provides additional security fixes for older PHP versions through its PHP packages.
Its backported fixes for these vulnerabilities cover ALT-PHP versions 5.2 through 8.5 on supported CloudLinux platforms.
This allows websites relying on older PHP versions to receive the relevant security fixes without necessarily switching to a newer PHP version immediately.
CloudLinux has also published updates for the EasyApache PHP packages used with cPanel.
The presence of CloudLinux on a server does not, on its own, verify that a PHP installation is patched. The updated packages must be installed, and patch availability varies according to the operating system and PHP packages in use.
Extended security maintenance for older PHP releases should not be regarded as a permanent replacement for upgrading.
We strongly encourage customers to plan a move to PHP versions officially supported by the PHP development team wherever possible. Security patching for older releases cannot be guaranteed indefinitely.
Actions for managed server customers
Our technical team is monitoring the required patch rollout across managed servers, where automatic security updates are enabled by default.
If you have switched off automatic updates or changed your server’s update configuration, ensure that the required PHP security patches are installed as soon as possible.
We also advise reviewing the PHP versions assigned to your websites and applications.
On CloudLinux servers, vendor patches may already be available for older PHP versions. Check that the appropriate CloudLinux packages have received those updates.
Even where a PHP version receives extended security maintenance, moving to an officially supported release remains strongly recommended wherever possible.
Please contact our support team if you need confirmation that the required patches have reached your server.
Responsibilities for self-managed servers
For a self-managed VPS, Cloud or Dedicated Server, maintaining and updating the operating system, PHP installations, control panel and other software is the customer’s responsibility.
Updates being available from cPanel, Plesk or CloudLinux does not mean they have already been installed on your server.
We strongly advise you to:
- Identify the PHP versions installed on your server and those actively used by your websites.
- Apply the latest security updates supplied by your operating system, cPanel, Plesk or PHP vendor.
- Verify that every affected PHP installation has received the required fixes.
- Assess older or unsupported PHP installations and schedule upgrades where appropriate.
If you use CloudLinux, check that the relevant ALT-PHP, EasyApache or operating-system PHP packages are updated. Backported fixes are available for some older releases, but they still need to be installed to address the vulnerabilities.
An unsupported operating system or software release may require an upgrade or an appropriate extended security support service.
These vulnerabilities are critical, so the relevant security patches should be applied as soon as possible.
Finding the PHP version used by each website
On a VPS, Cloud or Dedicated Server, websites sharing the same server may run different PHP versions.
Review each website individually, especially where older applications may still depend on unsupported PHP releases.
Reviewing PHP versions through cPanel and WHM
Administrators with WHM access can see the PHP versions assigned to domains across the server:
- Sign in to WHM.
- Open Software > MultiPHP Manager.
- Choose User Domain Settings.
- Check the PHP Version column beside each domain.
A domain marked Inherit normally follows the server’s default PHP version, unless another applicable configuration takes precedence.
The default version can be viewed under MultiPHP Manager > System Settings.
Individual account holders can also review their assigned versions through cPanel > Software > MultiPHP Manager.
On servers using CloudLinux PHP Selector, the version selection may be controlled through that interface instead.
Reviewing PHP versions through Plesk
To view the PHP version assigned to a website in Plesk:
- Sign in to Plesk.
- Open Websites & Domains.
- Find the website you wish to review.
- Select PHP or PHP Settings.
- Check the PHP version field.
Carry out the same checks for other websites or subdomains on the server.
These steps apply to both Linux and Windows installations of Plesk, although the available PHP versions may vary.
Important: Viewing the PHP version does not alter your website settings. It also does not establish whether the latest security patches are installed.
What an unsupported PHP version means
PHP 8.1 and earlier have reached the end of support from the PHP development team and no longer receive its regular security updates.
That does not automatically mean every installation running one of these versions is unpatched.
Hosting software vendors and commercial extended-support providers, including CloudLinux, may maintain their own older PHP packages and backport security fixes.
For PHP2Shell, CloudLinux has supplied fixes for older branches, including ALT-PHP packages covering PHP 5.2 through PHP 8.1.
A website using one of those versions may therefore have protection against these particular vulnerabilities, provided the applicable patched packages have been installed.
Vendor-maintained security coverage is different from official support by the PHP development team.
Extended-support providers may continue addressing security issues in older versions, but there is no guarantee that their coverage will include every future vulnerability or remain available indefinitely.
We therefore strongly recommend planning an upgrade from PHP 8.1 or earlier to an officially supported release, preferably PHP 8.3 or later, as soon as application compatibility permits.
An officially supported release offers a more sustainable basis for maintaining website and application security.
Planning a change to your website’s PHP version
Moving away from an older PHP release is strongly recommended, but the change should be planned carefully.
Older applications and custom code may behave differently under a newer PHP version, potentially affecting website functionality.
Before switching versions:
- Confirm that your website software and applications are compatible with the intended release.
- Take an appropriate backup.
- Test the change, preferably in a staging environment where one is available.
- Verify that the website works correctly after the upgrade.
If the existing PHP package has received a backported security fix, changing its main PHP version may not be required to resolve these specific vulnerabilities.
CloudLinux customers therefore do not need to rush a PHP version change solely because an older version number is shown, provided the relevant security patches have been installed and verified.
A move to a supported PHP release should still form part of your longer-term plans, because future fixes for older versions cannot be assured.
WordPress and other applications
The vulnerabilities affect PHP itself, rather than an individual WordPress plugin, theme or website application.
Updating WordPress or its plugins alone will not address a flaw in the PHP installation beneath the website.
Keeping application software updated remains an important part of website security. If you intend to move to a newer PHP release, check application compatibility before making the switch.
Support and further updates
Our technical team is continuing to follow developments and monitor the deployment of relevant security fixes.
- Shared Hosting: We manage the server-level patches and security measures. Customers do not need to take action for these updates.
- Managed VPS, Cloud and Dedicated Servers: We introduced recommended mitigations where appropriate before patches were released and are monitoring the update rollout. Automatic updates are enabled by default unless customers have altered or disabled them.
- Self-managed servers: Customers remain responsible for updating their server software.
Contact our 24/7 support team if you need help identifying your website’s PHP version, confirming whether your server has received the patches or understanding what action applies to your service.
Further announcements are also available through our service status page.
