Short version: two serious PHP bugs were disclosed on October 21, 2026. They affect almost every PHP website on the internet. If your site is on our shared hosting or Managed WordPress, we are patching it for you and you do not need to do anything. If you run your own VPS or dedicated server, you need to update PHP now, and this post tells you how.

What happened

The PHP project published fixes for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Together they are being called “php2shell”, after a demonstration video that chained them into remote code execution. Both are rated critical (CVSS 9.2).

  • CVE-2026-109618: when PHP runs out of memory part way through setting up a request, the cleanup that follows trusts half-built data. An attacker can shape a request so that this corrupts memory.
  • CVE-2026-109619: leftover state from one request can point at memory that has already been freed. The next request handled by the same worker can then reuse it. PHP also confirms this can leak memory contents.

The bugs are in PHP itself, not in WordPress or any plugin. Every way of serving PHP is affected: PHP-FPM, Apache’s mod_php, php-cgi, LiteSpeed and FrankenPHP. Researchers have shown working attacks against unpatched WordPress, Drupal, Joomla and Magento sites with no login required. Exploit code is circulating publicly. As of this post there is no confirmed wave of successful attacks, but scanning has started, and the only complete fix is to update PHP.

Which PHP versions have a fix

This is the part that matters, because not every PHP has a patch yet.

PHP versionStatus on October 22, 2026
8.5, 8.4, 8.3, 8.2 (php.net source)Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
8.1, 8.0, 7.4End of life. PHP only published source patches; no official release. You depend on your vendor to build them.
7.3 and older, down to 5.4End of life. No fix from the PHP project at all.
CloudLinux (cPanel servers, PHP Selector)Fixed builds shipped October 21 for the current branches, and through CloudLinux’s extended support also for the old ones, 5.2 through 8.1 included. A few branches were still waiting on a build when we checked and are being added as they ship.
Stock Linux distribution packages (AlmaLinux, Rocky, Debian, Ubuntu)Varies. Check your distribution’s security advisory. On October 22 the AlmaLinux 9 PHP 8.3 package, for example, had not yet shipped a fixed build.

What Canadian Web Hosting is doing

  • Shared cPanel hosting: our servers run CloudLinux, which released patched PHP builds the same day. We began rolling them out server by server on October 21, one PHP branch at a time, with a backup and a check of every site before and after. Older PHP versions that your site may still be using (5.6, 7.x, 8.0, 8.1) get patched too, because CloudLinux backports the fix to them. We will finish the remaining branches as the vendor ships each build.
  • Web application firewall: Imunify360 on every shared server is in blocking mode with rules for the known attack patterns. This is a safety net while patches roll out, not a replacement for them.
  • Managed WordPress: every site on our Managed WordPress platform was moved to a patched PHP 8.4 build on October 22, after a fresh backup of each site. Plugins and themes were brought up to date in the same window.
  • Our own systems: this blog and our internal tools were updated as part of the same work.

You do not need to open a ticket to ask whether your shared or Managed WordPress site is covered. It is. If you want to know which PHP version your site runs, it is shown in cPanel under MultiPHP Manager or Select PHP Version.

If you run your own server (VPS, cloud or dedicated)

Unmanaged servers are your responsibility to patch. Do this today:

  1. Find out what you run. php -v on the command line, and check the version your web server actually uses, which can differ.
  2. Update PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or to your vendor’s patched build. On cPanel servers run the EasyApache 4 updates (yum update "ea-php*") and, with CloudLinux, the alt-php* packages.
  3. Restart every PHP worker afterwards: php-fpm, Apache or LiteSpeed. A new version that is not restarted is not protecting you.
  4. Still on PHP 7.x or 8.0/8.1 from distribution packages? There may be no fix coming. Plan the move to 8.2 or newer now. CloudLinux’s PHP extended support is the one path that patches those old branches.

If you cannot patch yet, the PHP project lists settings that reduce exposure. They do not make a server safe; they buy time:

  • memory_limit = -1, set in a way applications cannot override (this removes the out-of-memory path the first bug needs; it is the opposite of normal advice, and only makes sense as a stopgap).
  • session.upload_progress.enabled = 0, and on PHP 8.5 also fatal_error_backtraces = 0.
  • Restart all PHP workers after changing these.
  • Put a web application firewall in front of the site, such as Imunify360 or Cloudflare, which have rules for the known attack patterns.
  • Do not run “proof of concept” code you find online to test yourself. Several circulating samples carry malware.

If you think a site was already hit

Signs include new files you did not upload, admin users you did not create, pages redirecting to spam, or your host’s malware scanner flagging the account. Change passwords, restore from a backup taken before the problem, then patch before bringing the site back. If you are not sure where to start, the options below exist for exactly this.

How we can help

Do not want to patch servers yourself? Let us run it.

  • Managed WordPress: we patch PHP, WordPress core, plugins and themes every week, with a backup before every change and a rollback if an update breaks the site. Every site on it was patched for PHP2Shell on October 22 without anyone having to ask.
  • Managed support for your VPS or dedicated server (an add-on to any CWH server plan): we keep the operating system, control panel and PHP patched, monitor the server, and handle incidents like this one for you. Email support@canadianwebhosting.com with the subject “PHP2Shell – managed support” or use Talk to our team, and we will quote it for your server.
  • Server retainer from iDig, our engineering team, for servers anywhere (not only ours): monthly security updates for the operating system and control panel in a window you agree once, monitoring that alerts a desk, a monthly backup check with a test restore, one engineer hour a month, and a written log of every change. Month to month. Prices are listed on the page.

Need it fixed once, now?

  • Server maintenance, desk hours (iDig): an engineer patches PHP and the control panel on your server, restarts the workers, checks for intrusions and malware, and reports what was done. Billed by the hour with a one-hour minimum; emergency work outside desk hours at the emergency rate. Phone 1-866-821-8355, 8 am to 6 pm Pacific, or book a free 30-minute scope call.
  • Site restore (iDig), for the site that is already broken or hacked: a fixed-price diagnosis, credited in full against the rescue, migration or rebuild if you go ahead within 60 days. Rescue means containment on the same desk day access is granted, a clean site within two business days of approval, and any missed back door re-cleaned free within 30 days. Also the right path for a site stuck on PHP 5 or 7 that no longer has a patch: a stack upgrade to current PHP and WordPress with every plugin and theme tested, the old site staying live until you approve the switch.
  • WordPress Rescue and Malware Cleanup on Canadian Web Hosting: the same clean-up for a site we host, quoted after a look at the site. Email support@canadianwebhosting.com with the subject “PHP2Shell – site rescue”.

Not sure which one you need? Open a ticket or email support@canadianwebhosting.com and mention “PHP2Shell”. We will tell you where your site stands and what, if anything, you need to do.

Sources

We will update this post as vendors ship the remaining builds.