# Critical PHP vulnerability (PHP2Shell): what we did and what you need to know

> Canonical: https://jethost.com/blog/php2shell-php-vulnerability/ · Last modified: 2026-10-22T07:03:33+00:00

On October 21, PHP released an emergency fix for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. They allow remote code execution and affect every hosting provider and every site running on PHP: WordPress, WooCommerce, Joomla, Magento, OpenCart, and others. We've updated all JetHost shared hosting servers and all Managed VPS. If your site is on shared hosting or a Managed VPS, it's protected and you don't need to do anything. If you have a self-managed VPS or dedicated server, you need to update PHP yourself. See how below.

## What is PHP2Shell

The vulnerabilities are in PHP itself, not in a specific plugin, theme, or CMS. They are rated 9.2 out of 10 on the CVSS scale. Every way PHP serves web requests is affected, including PHP-FPM, LiteSpeed, and Apache with mod\_php. An attacker doesn't need any access to the site: a single request is enough, and it's processed before the site's own code even loads.

## What we did

PHP released the fixed versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 on October 21 at 14:00 UTC. At 17:06 EEST (14:06 UTC), we started updating our servers. CloudLinux also released the patches for older versions, from 5.2 to 8.1, and we installed those too. The update was completed on October 22 at 07:09 EEST (04:09 UTC), and all PHP versions on our shared hosting servers and Managed VPS now include the fix. You don't need to restart anything on your side.

## What you need to do

### Your site runs PHP 8.2 or newer

Nothing. Your site is protected against PHP2Shell. If you're on PHP 8.2, keep in mind that official support for it ends on December 31, 2026. We recommend moving to 8.4, or at least 8.3.

### Your site runs PHP 8.1 or older

PHP no longer officially supports versions 8.1, 8.0, 7.x, and 5.x. We installed CloudLinux's patches for them too, so your site is protected, but we recommend switching to PHP 8.4. If your theme or plugins don't support it yet, choose at least 8.3. You can do it yourself in cPanel, under [Select PHP Version](https://jethost.com/kb/how-to-change-the-php-version-on-cpanel/). Take a backup first and check that your theme and plugins support the new version.

If you're not sure which version you're using, or you'd like us to switch it for you, open a ticket and we'll check your site.

### You run a self-managed VPS or dedicated server

We don't update PHP on self-managed VPS and dedicated servers, so you need to do it yourself as soon as possible. Update PHP to 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or install the patches from your PHP package provider if you run an older version. Then restart PHP-FPM and your web server. If you use LiteSpeed, also stop the lsphp processes (for example with `pkill lsphp`), because restarting LiteSpeed doesn't stop them.

## Updates

**Oct 21, 14:00 UTC:** PHP released the fixed versions.
**Oct 21, 14:06 UTC:** We started updating JetHost servers.
**Oct 21, 14:55 UTC:** CloudLinux announced it is preparing patches for older PHP versions, from 5.2 to 8.1, and expects to release them within about 5 hours. We'll install them as soon as they're out.
**Oct 21, 21:25 UTC:** CloudLinux released the patches for older PHP versions, from 5.2 to 8.1. We're installing them on our servers now.
**Oct 22, 04:09 UTC:** The update is complete. All PHP versions on JetHost shared hosting servers and Managed VPS include the fix.