Wednesday October 21, 2026
Gediminas G.
On October 21, the PHP project fixed two crucial vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now known as php2shell. Both are rated 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS). Details leaked before the planned release, and utilize code for one of them was already circulating before the fix was out. We blocked the utilize attempts already circulating, and we’re rolling out PHP’s update throughout our platform.
In short:
- Every Hostinger hosting scheme apart from VPS: nothing to do. We oversee PHP on these plans and have taken attention of it: the circulating utilize did not activity against our servers, our firewall rules are blocking requests that equivalent the attack, and we’re installing PHP’s fix on all server.
- VPS: if you oversee PHP on your own server, update it and restart it now. The steps are below.
What we cognize concerning the vulnerabilities
Both bugs arrive downward to how PHP cleans up recollection whenever a petition goes wrong. In the worst case, an attacker could run their own code on a server, peruse data they shouldn’t see, or obtain a location down.
| Vulnerability | What goes wrong |
| CVE-2026-109618 | A petition pushes PHP to its recollection bounds at exactly the incorrect moment. PHP stops halfway, leaves several data half-built, and afterward treats it as if it were complete. |
| CVE-2026-109619 | An error interrupts a request, and PHP holds onto recollection that has already been freed. The next petition handled by the identical procedure can afterward attain that leftover memory. |
Every PHP type before 8.5.12, 8.4.27, 8.3.36, and 8.2.35 is affected, going rear at smallest to PHP 5.4. That covers WordPress, WooCommerce, Magento, and most another PHP sites.
Because the flaw is in PHP itself, updating WordPress, themes, or plugins won’t fix it. Only a patched PHP does.
What we’ve done
First, we blocked the attacks already doing the rounds. We added safety rules that capture known utilize patterns and updated our firewall regulation set, which reaches all server operating ModSecurity automatically. The rules run in refuse mode, so any matching petition is rejected by the server immediately.
We additionally switched off session.upload_progress on our LiteSpeed, PHP Selector and cPanel PHP-FPM setups, and on phpMyAdmin. Hardly any sites use this feature, and turning it off closes one known path to CVE-2026-109619. On our web hosting platform, we now refuse malformed upload requests that PHP could misread.
Once PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, we rolled them out throughout the phase and emailed customers to let them know.
We’re motionless observing traffic closely and volition modify our rules if attackers alter tactics.
What you need to do
Every Hostinger hosting scheme apart from VPS: nothing. We oversee PHP for you, and the fix installs automatically. You can inspect the position here.
If you run PHP yourself on VPS:
On a VPS server that is operating PHP, you oversee PHP yourself, so our server-level protections don’t apply. Act now:
- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 as shortly as you can. It’s the lone complete fix.
- Can’t update direct away? Set session.upload_progress.enabled = Off in php.ini or your PHP-FPM pond config, afterward restart all PHP workers. Setting it in your code alongside ini_set won’t work. This lone blocks among the two bugs, so treat it as a stopgap.
- Turn off uploads you don’t need and keep upload size limits reasonable. It lowers your risk, but it isn’t a substitute for updating.
A few things that use to everyone:
PHP 8.1 and older versions no longer get fixes from the PHP project, but sites on them are motionless covered on our managed hosting. The identical protections we have use to all PHP version. Agency hosting already runs patched builds of all type it offers, and our PHP vendor has committed to patched builds for all type from 5.2 to 8.5 on Web, Cloud and cPanel hosting.
Still, now is a fine period to upgrade. Older versions young female many another safety fixes, and PHP 8.2 stops getting safety fixes on 31 Dec 2026. To upgrade your PHP version, go to the Hostinger dashboard → Websites → Dashboard → PHP Configuration and choice 8.3 or newer. Check that your theme and plugins assistance the new type first; if item breaks, you can toggle rear inside the identical login session.
Why you motionless need the PHP update
Firewall rules are a safety net. They halt the attacks we already cognize about, but attackers keep tweaking their requests to stumble former them. The PHP update fixes the genuine bug, so we treat the two as a pair: the update for the fix, the rules for additional cover.
Questions concerning your site? Our Customer Success squad is accessible 24/7 via live conversation in the Hostinger dashboard.
Gediminas is a communications expert passionate concerning technologies and their possibilities. His chief duty is to assistance group comprehend Hostinger products and their features. He likes spending his liberated period bathing in the hot tub, grilling, playing poker, fishing, and another activities.
