What happened
On 21 October 2026 the PHP project disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell”. They could allow an attacker to take control of a web server without logging in. They affect almost every PHP version, including the versions behind WordPress, WooCommerce, Joomla, Drupal, Magento and Laravel websites.
What SmartHost did
- Within hours of the announcement we applied a server-wide protective setting to every PHP version on every server we manage.
- Our web application firewall (Imunify360) received rules that block the published attack and its known variants.
- As fixed PHP versions were released by the PHP project, cPanel, CloudLinux, DirectAdmin and our other software vendors, we installed and tested them server by server, checking customer websites before and after every change.
- All of our servers are now updated, and our checks found no adverse impact on customer websites.
Do you need to do anything?
Most customers do not need to do anything. If your website uses an end-of-life PHP version (PHP 7.3 or older), some versions will never receive an official fix. Your site remains protected by our firewall rules and server-wide mitigation, but we strongly recommend upgrading to PHP 8.2 or newer.
You can check and change your PHP version in cPanel (MultiPHP Manager) or in DirectAdmin (PHP Version Selector). If you would prefer, our support team can change it for you and check your website afterwards.
More information
- Our archived live updates from 21 October 2026
- The PHP project’s security advisory
- NCSC Ireland advisory 2610210276
If you have any questions, our support team is available 24×7.
