We have been informed that PHP will release an update today at around 10 AM EDT on Wednesday October 21st to close two major exploits. The exploits are being called PHP2Shell and likely refer to CVE-2026-109618 and CVE-2026-109619 . While we are still waiting for more details on these exploits, they are very serious. They score at least 9.2 out of 10, which means hackers might be able to compromise sites/accounts/servers using PHP that are not patched against these exploits. The first problem faced when the patches are released is the period of time everyone will be vulnerable against these attacks once hackers see what the exploit is until we are able to apply the security updates. PHP is only providing updates for their currently supported versions (PHP 8.2 - 8.5) but its reported to impact versions at least all the way back to 5.4. The good news is our shared servers use CloudLinux's PHP hardening which means they are still backporting security updates to PHP versions all the way back to 5.2. All the shared customers will get patched against this exploit once its made available to us. While we will apply these patches right away, there currently is no ETA for how long we will be exposed to this exploit before we can get those patches. One of the advisories has given some PHP settings to change which might limit how effective the exploits are until we can update the servers. We are applying them tonight with the hopes it can help keep everyone safe.
For our VPS/Cloud/Dedicated customers, we will be also updated PHP as quickly as possible. cPanel will provide updated PHP packages once they're available, but it will only be for their supported versions. For the customers we have been providing their PHP 5.6 version backported to AL8, we will update it once we get the CloudLInux source RPMs. We will be evaluating updating any other PHP installs everyone has as well.
This announcement will be updated as more information becomes available about PHP2Shell and the status of the patches. Thank you in advance for your patience and understanding while we work on this issue facing your service.
Netwisp Support Team
Wednesday, October 21, 2026
