On 21 October 2026, the PHP project released a security fix for two critical vulnerabilities, nicknamed "php2shell": CVE-2026-109618 and CVE-2026-109619. Under certain conditions, they allow remote code execution on a server, without an account on the targeted website.
Your website is protected. The fixes have been applied across our entire infrastructure, for every PHP version we offer, from PHP 5.2 to PHP 8.5. You do not need to do anything.
This article explains which PHP version your website now displays, and where you can check for yourself that each version has been fixed.
What happened
- CVE-2026-109618: a request that hits the PHP memory limit at the wrong moment can leave partially initialised data, which PHP then treats as valid. The PHP project demonstrated remote code execution with the default configuration.
- CVE-2026-109619: a fatal error can leave internal state pointing to memory from a previous request.
The PHP project fixed these vulnerabilities in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older versions (8.1, 8.0, 7.x, 5.x) are no longer maintained by the PHP project and received no official fix.
Why our servers are protected
Our hosting servers run CloudLinux, an operating system built for shared hosting. The PHP versions you choose in your Apanel console are CloudLinux alt-php versions: CloudLinux maintains them itself and applies security fixes to them, including for versions the PHP project has abandoned.
CloudLinux released the fixes for both vulnerabilities on 21 October 2026, the same day as the PHP project's announcement, for every version from PHP 5.2 to PHP 8.5. For PHP 8.2 to 8.5, CloudLinux also released the PHP project's new official versions on the same day. We installed these updates on our servers as soon as they were released.
Few hosting providers can offer this: if your website still runs PHP 7.4 or PHP 5.6, it is fixed too, even though no official fix exists for these versions.
Which version your website displays
PHP 8.2, 8.3, 8.4 and 8.5: your website now displays the official version fixed by the PHP project, namely 8.5.12, 8.4.27, 8.3.36 or 8.2.35. You can check it with phpinfo(), phpversion() or in your CMS.
PHP 8.1 and older versions: the PHP project no longer releases new versions for these branches. CloudLinux therefore applies the fix directly to the existing version and publishes a new package. The PHP version number stays the same (for example 7.4.33); only the package revision changes (for example alt-php74 7.4.33-81, which contains the fix). This revision number does not appear in phpinfo().
For these older versions, a security scanner that relies only on the version number may wrongly report your website as vulnerable. You can forward this article to whoever ran the scan.
Check for yourself
For each version, the public CloudLinux changelog shows the package released on 21 October 2026 and lists both vulnerabilities, CVE-2026-109618 and CVE-2026-109619: fixed by the new official version for PHP 8.2 to 8.5, and by a fix built into the package for older versions.
What we recommend
You do not need to do anything to be protected against these two vulnerabilities. If your website uses an older PHP version (before 8.2), we still recommend moving to a recent version when your website allows it: a recent version is faster and is still maintained by the PHP project itself.
Further reading