If your site runs on PHP, please update it now. On 21 October 2026 the PHP project released emergency fixes for two critical vulnerabilities, nicknamed “php2shell”, that let an attacker run code on a web server without logging in. CISA has published an alert, Critical Vulnerabilities in PHP Require Immediate Patching, urging everyone to patch immediately.
The good news: our platform already fully supports PHP 8.2 and newer. Upgrading to a patched PHP 8.2+ release fixes the issue, with no changes needed on the platform side.
Am I affected?
Almost certainly, unless you have already updated since 21 October. Every PHP installation that serves web requests is at risk: Apache with mod_php (highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.
| PHP branch | Patched version | Status |
|---|---|---|
| 8.5 | 8.5.12 or later | Fixed |
| 8.4 | 8.4.27 or later | Fixed |
| 8.3 | 8.3.36 or later | Fixed |
| 8.2 | 8.2.35 or later | Fixed |
| 8.1 and older | None | End of life, no official fix: upgrade to 8.2+ |
Our platform is ready for PHP 8.2+
Our platform is already tested and compatible with PHP 8.2, 8.3, 8.4 and 8.5. You can move to any patched release above without code changes on our side. If you are still on PHP 8.1 or older, this is the moment to upgrade: those versions will not receive a fix.
VPS hosting and cloud service customers: you’re already protected
If you host with us on a VPS or our cloud service, no action is needed. Our team has already updated PHP on all servers we manage to the patched releases and restarted PHP so the fix is active. Your sites are protected against both vulnerabilities and should continue to run normally.
If you manage your own PHP installation on a self-managed server, please follow the steps below.
What you need to do
- Check your PHP version. Run
php -von the server, or check your hosting control panel. - Back up your site files and database before changing anything.
- Upgrade to a patched release: 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or later).
- Using a package manager (apt, yum/dnf) or a hosting panel: install your vendor’s updated PHP packages.
- Using Docker: rebuild with the latest PHP base image (
docker build --pull). - Building from source: download the fixed release from php.net.
- Restart PHP (PHP-FPM, Apache or LiteSpeed) so the new version is loaded in memory.
- Verify with
php -vand a quick test of your site’s key pages, logins and forms.
Prioritize internet-facing servers first.
Can’t upgrade today?
PHP’s advisory lists temporary configuration changes (in php.ini or your PHP-FPM pool, followed by a PHP restart) that block the known attack paths. These are stopgaps only: they do not fully protect against CVE-2026-109618. If you use a web application firewall such as Cloudflare, its rules for the known exploits add another layer. Please schedule the upgrade as soon as possible.
Need help?
Our support team can help you check your PHP version, plan the upgrade or verify your site afterwards. Contact us at [support email / link] and mention “PHP security update” so we can prioritize your request.
