Status: resolved for hosted customers
Overview of the issue
Two critical security vulnerabilities have been discovered in the PHP programming language. These issues are known as “PHP2Shell” and carry a CVSS v4.0 score of 9.2, representing a very high level of severity.
The vulnerabilities affect:
CVE-2026-109618 (Out-of-Memory Corruption)
CVE-2026-109619 (Stale Global State/Use-After-Free)
These flaws could potentially allow attackers to execute arbitrary code on servers without authentication, access sensitive data, and compromise customer information.
Current status - hosting customers
All of our hosting infrastructure has been secured.
We have completed the security update across all our hosting environments including:
- Web Hosting Accounts
- Managed WordPress Hosting
- Cloud VPS Environments (Hosted by Us)
- Dedicated Server Plans (Managed Service)
- Reseller Hosting Packages
- All customers on our platform are now running patched, secure versions of PHP.
Important - VPS & Dedicated Servers
If you are running your own web server on a VPS or Dedicated Server provided by us you must update your system manually.
Why?
VPS/Dedicated servers require you to manage your own OS
Your web server configuration must be updated individually
Security patches must be applied through package management
Required actions for self-managed hosting:
1. Check your current PHP version (php -v)
2. Update to the latest patched version available
3. Restart your web server service after updating
4. Verify all applications work correctly post-update
5. Review any custom configurations that may affect PHP behavior
If you use any other hosting providers
We recommend you contact other hosting providers to verify:
1. If you have websites hosted on multiple hosting accounts
2. Whether your primary or secondary hosts have patched PHP
3. Request status updates from each provider separately
4. Ensure all of your web presence is covered by patches
Your security depends on ALL environments being updated, not just the one we manage for you.
Verifying your security status
To check if your system is protected:
1. Log into your control panel or server
2. Check PHP version via command line or file manager
3. Compare against the required patched versions:
PHP 8.5: 8.5.12 or higher
PHP 8.4: 8.4.27 or higher
PHP 8.3: 8.3.36 or higher
PHP 8.2: 8.2.35 or higher
If you see a lower version number, you need to update immediately before the fix becomes available.
Summary - key takeaways
Our hosted infrastructure is already patched and secure
VPS/Dedicated server owners must update their own systems
Multiple hosting providers = verify each one individually
Updates are available now and should be applied immediately
Contact support if you need help with the upgrade process
We take customer security very seriously and have prioritized these updates above all other maintenance tasks. Your trust in our security measures is why we act this quickly.
For real-time status updates, please check:
Customer Portal Security Dashboard
Email notifications from our security team
Blog posts for ongoing information
STAY SAFE BY STAYING PATCHED.
