php2shell: Critical PHP Security Updates (October 2026): All EDZNET Servers Patched

On 21 October 2026 the PHP project released urgent security updates for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, known together as “php2shell” and both rated 9.2 out of 10 for severity. They affect almost every website running PHP, including WordPress, WHMCS and custom PHP applications.

All EDZNET servers have been patched. You don't need to do anything.

What was the problem?

Both issues are in the way PHP handles incoming web requests, such as forms and file uploads. A specially crafted request could corrupt PHP's memory or expose data left over from an earlier request. Because this happens before your website's own code runs, keeping WordPress or your plugins up to date would not have protected you on its own. The fix had to be made to PHP itself, on the server.

What we've done

• Every PHP version on our servers has been updated with the fixed builds released by CloudLinux, which provides the PHP packages we run.
• That includes older versions. The PHP project only released fixes for PHP 8.2 and newer. CloudLinux back-ported the same fixes to older versions, so sites still on PHP 7.x, 8.0 or 8.1 are protected too, not just sites on current PHP.
• Exploit attempts are blocked before they reach PHP. Our server-level firewall, BitNinja, has a dedicated web application firewall rule (410053) that blocks php2shell exploit attempts, and it's active on all of our servers. That's an extra layer on top of the patched PHP builds, not a replacement for them.
• Each hosting account is isolated from the others, so one site can't affect another.

About older PHP versions

All client sites have now been moved to PHP 7.0 or newer, so PHP 5.x versions are no longer enabled on our servers by default. If you have an older system that still needs one, it remains available on request and receives the same patched CloudLinux builds. Please open a support ticket and we'll set it up for you.

If you're running an older custom or bespoke system and aren't sure what to do next, our guide Stuck on an old PHP version? Your options for legacy and bespoke systems explains how we keep these systems safe and how to bring them up to date in stages.

If you host elsewhere

If you run any websites on another host, a VPS or your own server, make sure PHP has been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer, or to your provider's patched build. There is no complete workaround: updating PHP is the only full fix. We're happy to move sites to our servers if you'd rather not manage this yourself.

Questions? Contact our support team.

References: PHP security release announcement · CloudLinux incident status · BitNinja WAF rule 410053