Critical PHP vulnerability (PHP2Shell): what we did and what you need to know

On October 21, PHP released an emergency fix for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. They allow remote code execution and affect every hosting provider and every site running on PHP: WordPress, WooCommerce, Joomla, Magento, OpenCart, and others. We’re updating all JetHost servers right now. If your site runs PHP 8.2 or newer, you don’t need to do anything.

What is PHP2Shell

The vulnerabilities are in PHP itself, not in a specific plugin, theme, or CMS. They are rated 9.2 out of 10 on the CVSS scale. Every way PHP serves web requests is affected, including PHP-FPM, LiteSpeed, and Apache with mod_php. An attacker doesn’t need any access to the site: a single request is enough, and it’s processed before the site’s own code even loads.

What we did

PHP released the fixed versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 on October 21 at 14:00 UTC. At 17:06 EEST (14:06 UTC), we started updating our servers. CloudLinux has also released the patches for older versions, from 5.2 to 8.1, and we’re installing them now. Until the update is complete, WAF rules that detect attempts to exploit these vulnerabilities are active on our servers. You don’t need to restart anything on your side.

We’ll keep this article updated until we’re done and log every change in the Updates section below.

What you need to do

Your site runs PHP 8.2 or newer

Nothing. We update PHP for you, and your site is protected against PHP2Shell as soon as the update reaches your server. If you’re on PHP 8.2, keep in mind that official support for it ends on December 31, 2026. We recommend moving to 8.4, or at least 8.3.

Your site runs PHP 8.1 or older

PHP no longer officially supports versions 8.1, 8.0, 7.x, and 5.x. CloudLinux has released patches for them too and we’re installing them now, but we recommend switching to PHP 8.4. If your theme or plugins don’t support it yet, choose at least 8.3. You can do it yourself in cPanel, under Select PHP Version. Take a backup first and check that your theme and plugins support the new version.

If you’re not sure which version you’re using, or you’d like us to switch it for you, open a ticket and we’ll check your site.

You run a self-managed VPS or dedicated server

Update PHP to one of the fixed versions as soon as possible and restart PHP-FPM and your web server. If you use LiteSpeed, also stop the lsphp processes (for example with pkill lsphp), because restarting LiteSpeed doesn’t stop them.

Updates

Oct 21, 14:00 UTC: PHP released the fixed versions.
Oct 21, 14:06 UTC: We started updating JetHost servers.
Oct 21, 14:55 UTC: CloudLinux announced it is preparing patches for older PHP versions, from 5.2 to 8.1, and expects to release them within about 5 hours. We’ll install them as soon as they’re out.
Oct 21, 21:25 UTC: CloudLinux released the patches for older PHP versions, from 5.2 to 8.1. We’re installing them on our servers now.