So…a lot of people are seeing articles across the internet about an emergency PHP vulnerability. This mostly happened on October 20, 2026, with an emergency patch being released at 10AM ET on October 21, 2026. Let’s take a look at how it happened and how it’s being fixed.
Before we go any further, I Heart Blank / I Heart Sites hosting is fully updated to with the security patch. This article is to educate what happened and how it got fixed.
What is PHP?
PHP is basically a scripting language. You can files that end in .php, and php code. Here are some basics of what PHP can do:
- PHP can generate dynamic page content
- PHP can create, open, read, write, delete, and close files on the server
- PHP can collect form data
- PHP can send and receive cookies
- PHP can add, delete, modify data in your database
- PHP can be used to control user-access
- PHP can encrypt data
Just like a program on your computer, PHP also has ‘releases’. So, there are cases where you might be using PHP 8.1, and someone else might be using PHP 8.4. As time goes on and PHP is updated, some versions/releases of PHP can go ‘out of date’. For example, while PHP 7.4 isn’t that old, it is rarely used anymore. As of writing this article, I believe PHP 8.6 is the highest stable release.
While PHP can be used as ‘stand alone’ coding for a website, it’s important to remember that CMS’s like WordPress, Joomla and Drupal also heavily use PHP. According to The Verge, more than 40% of the internet uses PHP.
What Happened with the PHP Vulnerability?
So…someone found an exploit in something called “#php2shell”. The Cloudflare CEO wrote this on X:
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
– Matthew Prince (Twitter)
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
— Matthew Prince 🌥 (@eastdakota) October 22, 2026
As a result, php.net announced an Upcoming Critical PHP Security Release on October 20, 2026. Then on October 21, 2026 the release was put out at 10AM ET. The security release focused on two vulnerabilities: CVE-2026-109618 and CVE-2026-109619 for the following versions of PHP:
- 8.2.35
- 8.3.36
- 8.4.27
- 8.5.12
How Do These Releases Get Updated For Your Website?
While I was ensuring I Heart Blank, LLC hosting clients were updated, I had to do a little recon of my own.
WHM/cPanel
Most of my clients, and clients I deal with are either on my hosting, or using cPanel. You can think of cPanel as a ‘control panel’ for your hosting account. It’s where you can set up your email accounts, view files, update your PHP, etc. cPanel released an update immediately. If you’d like to check, your version of cPanel (or WHM) should be 138.0.18, 136.0.50, and/or 134.0.66.
Here is the cPanel release note from October 21, 2026:
We updated cPanel & WHM’s internal PHP packages to address critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619). This update affects PHP in cPanel interfaces, including Roundcube webmail.
cPanel & WHM versions 138.0.18, 136.0.50, and 134.0.66 include PHP 8.4.27. cPanel & WHM version 110.0.153 includes backported security fixes for PHP 8.1.34.
For a full list of changes, visit the cPanel & WHM change logs and select your version.
WordPress Hosting (WPEngine, Siteground, etc)
I got confirmation that WPEngine and Siteground immediately deployed the updates. While I can’t confirm all of the WordPress Hosting companies, I would assume that any managed, paid WordPress hosting platforms didn’t deploy the security fixes. If you’re unsure, you can use your favorite search engine and search something like “did yourhostingcompany deploy the october php update”
Other Share Hosting
If you’re on a ‘shared hosting’ account, chances are you’re on cPanel. You can check the updated cPanel versions above, and compare it to the version on the bottom of your cPanel dashboard (landing page when you log in).
Similar to above, you can also use a search engine to get some answers with your current hosting company.
Conclusion
This was a bit of a big deal. It feels to me like the entirety of the internet came together to get the word out, and get the security patches deployed as soon as they were available. It’s nice to see, actually. If you have any other questions, please feel free to shoot me a message. While I’m not the most knowledgable about all the in-and-outs of PHP, I did do a bit of research to educate myself in this paticular matter.
Additional Reading
About the Author: Tom DuHamel
