Two critical security vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), can allow an attacker to run malicious code on an affected server without logging in. PHP installations serving web requests are at risk, including websites and hosting control panels.

PHP powers applications such as WordPress, Moodle and Joomla, as well as parts of panels such as cPanel and Plesk. Updating your website's plugins or application alone does not update the underlying PHP software. Installing patched PHP packages is the complete fix.

Web cluster websites and webmail

We have updated the PHP versions used on our WebAddress web cluster, including the webmail front end to our email service. We have also updated the legacy portal.

If your website is hosted on our web cluster, we manage these PHP updates for you. You do not need to install the server updates yourself.

Customers with a VPS

We are reviewing customer VPSs to identify their PHP versions and work out the appropriate update path for each server. Updating the web cluster does not update PHP on your individual VPS.

For managed VPSs, we will contact you to discuss the required changes and agree how to proceed. Please contact us if you have particular requirements, use a hosting control panel, or know of applications that depend on an older PHP version. These details can affect the update approach and any downtime.

If you manage your own VPS, please arrange PHP updates promptly. You do not need to wait for our review. If you have already updated it, please let us know what you have done.  If your distro does not include fixed packages, you may wish to consider the Sury PHP package repository.

Updating your own VPS

Install the PHP security updates supplied by your operating system or hosting-panel provider. Check every PHP version used by your websites: a server can have several versions installed, and the version shown by php -v may differ from the one serving a website.

After updating, ensure the processes serving PHP have restarted and are using the patched packages. This normally means restarting PHP-FPM, or Apache where PHP runs as an Apache module. Then check your websites and applications.

Older operating systems may no longer receive PHP security updates through their usual repositories. These servers may need an operating system upgrade or another supported PHP package source. Please contact us if updates are unavailable or you are unsure how to proceed.

If you cannot install patched PHP promptly, take the affected PHP websites and web interfaces offline until they can be updated. This includes PHP-based control panels and webmail running on your VPS. Configuration changes alone do not provide complete protection.

Further information

For a plain-language explanation, see Malwarebytes:
https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates

PHP's security advisory:
https://www.php.net/archive/2026.php#2026-10-21-5

Please subscribe to this notice for further updates, or contact support for help with your server.