On October 21, 2026, the PHP project released emergency security updates for two critical flaws nicknamed "PHP2Shell": CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 (CVSS v4.0). The Canadian Centre for Cyber Security describes them as use-after-free flaws that could let an unauthenticated attacker run their own code on a server, meaning no password or account is needed.
PHP runs a large share of the web, including WordPress and many custom business sites. Two days later, on October 23, PHP disclosed a third flaw, CVE-2026-115560. The October 21 updates do not fix it, and it needs an unusual mix of PHP settings and application code to be exploited.
Who is affected
Any site running PHP can be affected, and the flaws go back many years. The fixed versions are:
- PHP 8.5: fixed in 8.5.12
- PHP 8.4: fixed in 8.4.27
- PHP 8.3: fixed in 8.3.36
- PHP 8.2: fixed in 8.2.35
- PHP 8.1 and older: no official fix (end of life)
A public proof-of-concept exploit exists. Sophos reported scanning and a small number of failed attempts, with no confirmed compromise as of October 22, and says building a reliable exploit is difficult. The Cyber Centre warns that this can change quickly. Treat it as urgent, not as a panic.
What to do this week
The only complete fix is to update PHP itself. Plugins, themes and a firewall do not replace that.
- Find out your PHP version. Your developer or hosting control panel shows it.
- Update PHP on the server. On shared hosting the host controls the patch release. Ask your host in writing whether the October 21 fixes are in place.
- Leave PHP 8.1 and older. Plan the move to a supported version and test your site first.
- Apply the interim setting. Until CVE-2026-115560 is fixed, the Cyber Centre says to set
session.upload_progress.enabled=0in PHP. - Look for signs of trouble. Check logs for strange requests, and look for unexpected files, accounts or processes.
- Keep a recent backup stored somewhere other than your hosting account.
What hosting providers said
Most people do not run PHP themselves. Their host does, so the useful question is what your host says it has done. Here is where several large providers stood as of October 24, 2026. Treat each statement as the host's own word: "protected" usually means firewall rules or a managed platform, which is not the same as the PHP fix itself.
Hostinger
Hostinger says the circulating exploit "did not work against our servers" and that it has seen no increase in malware infections or unusual activity. It blocked known exploit patterns with firewall rules on October 21, turned off session.upload_progress on its LiteSpeed, PHP Selector and cPanel PHP-FPM setups, and finished installing patched PHP builds on October 22 at 06:44 UTC. Every Hostinger plan except VPS needs no action from the customer. On a VPS you manage PHP yourself, so you must update it, or set session.upload_progress.enabled to Off in php.ini or the PHP-FPM pool config and restart PHP (setting it with ini_set will not work). Hostinger notes its patched builds may keep the same version number; check the Build Date under Dashboard, PHP Info. October 21, 2026 or later means the fix is present.
Other hosts
The independent ActiveSet tracker records what each host published (it does not test servers). As of October 24:
- Patched: SiteGround, Kinsta, WP Engine, Cloudways, DreamHost, Namecheap
- Partly patched: GoDaddy (managed WordPress, Windows and Web Hosting done; check for a build dated October 21 or later; VPS is self-managed), A2 Hosting (self-managed VPS excluded), OVHcloud
- Still patching: Bluehost, HostGator, Liquid Web, Nexcess
- Protected, in the host's words: WordPress.com, Pressable
- Self-managed, you must update: DigitalOcean, AWS
No host in the roundups we read claimed its platform was unaffected, and the tracker lists no Canadian hosts. Cloudflare deployed firewall rules for all customers, but its CTO called them a stopgap.
What this means for you
- Shared or managed hosting: your host handles PHP. Ask for written confirmation.
- VPS, cloud or dedicated servers: you own the update.
- Older PHP: some hosts backport fixes to PHP 8.1 and older, others do not. Ask yours.
FAQ
Is my WordPress site affected? WordPress runs on PHP, so it is if the server's PHP is unpatched. The fix is the PHP update on the server, not a plugin update.
Will updating PHP break my site? It can, mostly on older custom code or old plugins. Test the new version first and keep a backup.
Has my data been stolen? Nothing public suggests so, but you should still patch and check your logs.
Do I need to rebuild my site? No. Moving to a supported PHP version is a server change.
Need help checking your site or planning a safe PHP upgrade? Contact GoshenWebX.