Latest updates

Newest first. All times are Irish time. Links open in a new tab.

• 21 October
  Security firm Tenable cites an estimate that more than 1.3 million internet-facing servers are potentially vulnerable, and says code claiming to exploit the flaws is circulating publicly, although it has not verified that it works. Source: Tenable
• 21 October, 14:50
  cPanel releases patched PHP. cPanel has published fixed PHP packages for its EasyApache 4 platform: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, plus back-ported fixes for PHP 7.4 and 8.1. CloudLinux, which supplies PHP on many shared hosting servers, had not yet released its updates. PHP 7.2, 7.3 and 8.0 have no fix from either vendor. Source: SmartHost, from cPanel’s package changelogs (EA-13609 to EA-13613)
• 21 October, 14:43
  SmartHost update: our team is deploying immediate mitigations across our hosting servers, and is installing the patched PHP versions as cPanel and CloudLinux release them. We will post progress here. Source: SmartHost
• 21 October, about 14:35
  PHP releases the fix. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix both critical vulnerabilities, and the PHP project says “all PHP users are strongly encouraged to update immediately”. It names mod_php as the highest-risk setup, with a demonstrated exploit that works before any website code runs. Sources: PHP security advisory, PHP changelog
• 21 October, about 14:35
  PHP 8.1 and older get no official release. Because of the severity, the PHP security team has published source patches for PHP 7.4, 8.0 and 8.1 for those who build PHP themselves, and says Linux vendors received the patches in advance. Source: PHP security advisory
• 21 October, 14:57
  No advisory yet from Ireland’s National Cyber Security Centre. Its most recent critical alert, on 20 October, covered BeyondTrust rather than PHP. Source: NCSC Ireland
• 21 October, 11:44
  RTÉ News reports the EU warning that websites may need to be taken offline, and quotes Australia’s Cyber Security Centre saying it is “not aware of active exploitation”. Source: RTÉ News
• 21 October
  The UK’s National Cyber Security Centre urges organisations to “prepare for immediate updating of systems using PHP”, and to consider taking systems offline until they can be fixed. Source: NCSC (UK)
• 21 October, 11:01
  The Next Web reports that the PHP project brought its release forward by a day after security firm watchTowr said it had reproduced one of the flaws. Source: The Next Web
• 21 October, 08:34
  WordPress security firm Patchstack says it has received reports of active exploitation from multiple hosting companies, and that Cloudflare is also seeing early attacks. Source: Patchstack
• 20 October, evening
  CERT-EU, the cyber security service for the EU institutions, publishes Security Advisory 2026-018. It warns that every PHP version from PHP 5 onwards could be affected, and advises isolating internet-facing applications that cannot be patched. Source: CERT-EU
• 20 October
  Security firm Huntress publishes a rapid response, noting it had not yet seen attacks in the wild. E-commerce security firm Sansec publishes its own analysis of the flaws. Sources: Huntress, Sansec
• 20 October
  Details of the vulnerabilities leak online ahead of the planned disclosure. Sources: BleepingComputer, Infosecurity Magazine
• 20 October
  The PHP security team gives advance notice of an emergency security release for two critical vulnerabilities, and urges all PHP users to prepare to upgrade. Source: PHP project

What SmartHost is doing

• We are deploying immediate mitigations across our hosting servers now, to reduce exposure while patching is under way.
• The PHP fix is now out. We are applying the patched PHP versions across our hosting servers as they become available from our software vendors, cPanel and CloudLinux.
• Once the technical details are published, we will add our own web application firewall rules on our servers to block known attack attempts, without waiting for vendors.
• We have reviewed the PHP versions in use across our hosting platform and are contacting customers whose websites run a version that will not be fixed.
• At customers’ request, we have already taken several websites offline and replaced them with simple holding pages until they can be updated.

What has happened

On 20 October 2026, the PHP project announced an emergency security release for two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated critical, with a score of 9.2 out of 10 on the CVSS v4.0 scale. They have been nicknamed “PHP2Shell”.

PHP is the programming language that powers most websites, including WordPress, Joomla, Drupal, Magento and Laravel sites. Because the flaws are in PHP itself, any website running an affected PHP version may be exposed, whatever platform or plugins it uses.

According to CERT-EU, the severity rating indicates a risk of unauthenticated remote code execution: an attacker could run their own code on a web server without needing a username or password. In practical terms, they could take control of an affected website, change its content, steal data or use the server to attack others.

Details of the flaws leaked before the fix was ready. Reports on whether they are already being exploited differ: Patchstack says attacks are under way, while Australia’s Cyber Security Centre, quoted by RTÉ, said it was not aware of active exploitation. We are treating the threat as active.

Which versions are affected

The PHP project released fixed versions on 21 October 2026:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35 (PHP 8.2 reaches end of life on 31 December 2026, so plan to move beyond it)

PHP 8.1 and older, including PHP 8.0, 7.x and 5.x, are end-of-life and get no official release. The PHP project has published source patches for PHP 7.4, 8.0 and 8.1, and some software vendors provide their own fixes, but the safest course is to move to a supported PHP version. Source: PHP security advisory

What you should do

1. Check your PHP version. In cPanel, you can see this under MultiPHP Manager or Select PHP Version. If you are not sure, contact us and we will check it for you.
2. Plan an upgrade if your site runs PHP 8.1 or older. Moving to a supported version is the only long-term fix. Older websites, plugins or themes may need updates before they work correctly on a newer PHP version, so we recommend testing the change first.
3. Keep WordPress, themes and plugins up to date. This will not fix the PHP flaw, but it reduces the risk of other weaknesses being used alongside it.
4. Make sure you have a recent backup of your website and database.
5. Be wary of unofficial “fixes”. Do not install plugins or paste code snippets that claim to fix this issue, and be cautious of unexpected emails offering to fix it for you. Scammers often use news like this to contact website owners.

If you think your website has been compromised

Contact us straight away at support@smarthost.ie or on 01 901 9700. Irish organisations should also be aware of their reporting obligations:

• Personal data: if customer or staff personal data may have been exposed, the Data Protection Commission requires most breaches to be reported within 72 hours of becoming aware of them.
• Cyber crime: fraud, extortion and other cyber crime should be reported to An Garda Síochána.
• Significant incidents: organisations covered by the NIS2 rules, and incidents with possible national impact, can be reported to NCSC Ireland.

Need help or want your website taken offline?

If you would prefer to take your website offline while it is reviewed or upgraded, our team can do this for you. We can replace your site with a simple HTML holding page with your logo and a short message, and restore it when you are ready.

If you would like our team to take down your website, or you have any questions about this vulnerability, please contact us at support@smarthost.ie or call 01 901 9700.