Security notice
Our servers are protected against the PHP2Shell vulnerability
- CVE-2026-109618
- CVE-2026-109619
A recent security issue was found in PHP, the software that powers most websites, including WordPress and Joomla sites. Here is what happened and the steps we have taken to keep our customers' websites safe.
What happened?
On 21 October 2026, the PHP development team announced two critical security vulnerabilities, known as PHP2Shell, with the official reference numbers CVE-2026-109618 and CVE-2026-109619. These issues affect PHP itself rather than any individual website, theme or plugin, and they affect web servers worldwide. If left unpatched, they could allow an attacker to take control of a website without needing a password.
What have we done?
As soon as the fixes were released, our team applied the security updates across all of our web servers. The following PHP versions have been updated to their patched releases:
PHP 8.5
8.5.12
PHP 8.4
8.4.27
PHP 8.3
8.3.36
PHP 8.2
8.2.35
PHP 7.4
7.4.33
with security fix
On top of the updates, we have disabled a PHP feature that this vulnerability can use as a way in, on every PHP version we run. We have also tightened server settings and increased monitoring for suspicious activity as an added layer of protection.
Websites running older PHP versions
Websites still running the much older PHP 5.4 have been moved to a separate, isolated server, where additional protective measures have been applied. This keeps them apart from the rest of our hosting environment.
Older PHP versions, including PHP 7.4 and PHP 5.4, no longer receive regular security updates from the PHP developers. To keep every website secure in the long term, we will contact each customer whose website runs on PHP 7.4 or PHP 5.4 with an upgrade plan to move to PHP 8.4 or newer. Depending on the website, this may involve:
- updating older Joomla websites, including those still on Joomla 1.5
- updating WordPress plugins, themes or custom-developed features so they work with newer PHP versions
- where an update isn’t practical, a redesign or rebuild of the website
Each affected customer will receive a full report on their website, with our recommendations and available options. We will guide you through the process and make sure the move goes smoothly.