We have completed a PHP security update across all our shared hosting servers and retired two legacy PHP versions. Please take a moment to read this — the first section explains what the flaw actually was, because it affects every PHP website we host.

What the vulnerability was

In late October, two related security flaws were disclosed in PHP itself — tracked as CVE-2026-109618 and CVE-2026-109619, and widely referred to as “PHP2Shell”. They affect the part of PHP that handles incoming requests:

• the parser that processes multipart form and file uploads;
• the session upload-progress handler, which tracks an upload while it is still in progress; and
• the memory allocator, when it runs out of memory mid-request.

Under the right conditions, a deliberately crafted request could cause PHP to execute code on the server instead of simply processing the request. That is why it is called PHP2Shell: a request becomes a shell.

Three things made this serious:

• No password needed. It is triggered by a request to the website, not by logging in.
• No plugin or theme at fault. The weakness is in PHP itself, so any PHP site could be a target regardless of what it runs.
• No file upload required. Nothing has to be written to disk first — the code execution happens during request handling.

In other words, this was not a hosting configuration mistake or a bad plugin. It was a defect in the PHP engine, and the only real fix was to patch PHP.

What we did

• Applied the vendor security patch to every PHP version we provide — from PHP 5.3 through 8.5.
• Removed PHP 4.4 and PHP 5.1. No patch was ever released for these versions, and none ever will be: they are around 15 years old and unsupported. Leaving them selectable would have left a permanent, unfixable hole. No hosting account was using them.
• Added automated hourly checks that verify every PHP version on the server still carries the fix, and alert us if one falls behind.

No action is required if your site is running PHP 5.2 or newer.

Please check your PHP version

You can view and change it in cPanel › MultiPHP Manager (or Select PHP Version).

Why we still recommend upgrading. Every version currently on our servers has been patched against this specific flaw, including old ones. But PHP 8.1 and below no longer receive updates from the PHP project, so when the next vulnerability is disclosed, those versions depend entirely on our vendor backporting a fix — and for the oldest versions, that will not happen again. That is the real reason to move to 8.2 or newer: not this flaw, the next one.

Regards,
BigDomain Support