PHP2Shell: Your HostHolder Website Is Protected
All HostHolder servers are fully patched against the critical PHP flaws CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"). Protection was in place from the day the flaws were announced, 21 October 2026, and no customer site has needed to go offline.
What happened
On 21 October 2026, the PHP project fixed two critical flaws that let an attacker run code on a web server without any password. Both are rated 9.2 out of 10 (CVSS v4), and public exploit code is already circulating.
CVE-2026-109618: remote code execution through out-of-memory corruption.
CVE-2026-109619: remote code execution through stale data left over between requests.
The flaws affect PHP 7.x and 8.x on almost every kind of web server. On 22 October, Bangladesh's government cyber security team (BGD e-GOV CIRT) issued an urgent alert. As a precaution, Bangladesh Bank, six commercial banks and the land services portal took their websites offline. Bangladesh Bank's site returned on 25 October after security checks.
What HostHolder did
We acted on the day of the announcement, so our servers were never left exposed and no website had to be switched off.
Date | Action | Status |
|---|---|---|
26 Oct 2026 | Verified every PHP package, firewall ruleset and control panel version on the server | Done |
23 Oct 2026 | Installed the patched PHP builds: 8.2.35, 8.3.36, 8.4.27 and the patched 7.4 build | Done |
By 26 Oct 2026 | Imunify360 firewall rules that block known PHP2Shell exploit attempts (ruleset 8.89) | Active |
By 26 Oct 2026 | cPanel & WHM 11.138.0.18 and WP Toolkit 6.11.6, which also fix a separate WordPress Toolkit flaw | Done |
21 Oct 2026 | Applied the official interim mitigation on every PHP version, within hours of the advisory | Done |
Ongoing | Daily malware scans, real-time file scanning and automatic isolation of infected accounts | Active |
Our servers run PHP through PHP-FPM rather than the riskier mod_php setup that the advisory warns about most.
What you should do
Your site is already protected, but we strongly recommend running it on a PHP version that still receives security updates. PHP 8.1 and older no longer get official fixes, and PHP 8.2 reaches end of life on 31 December 2026.
PHP version | Security support | Our advice |
|---|---|---|
8.4 | Active | Recommended |
8.3 | Active | Recommended |
8.2 | Ends 31 Dec 2026 | Plan to upgrade now |
8.1 and older | Ended | Upgrade as soon as possible |
How to change your PHP version in cPanel:
Log in to cPanel and open MultiPHP Manager.
Tick your domain and choose PHP 8.3 (or 8.4) from the list.
Click Apply, then open your website and check that everything works.
If something breaks, switch back the same way and ask your developer to update the site's code.
Also, please:
Keep WordPress, plugins and themes up to date, and remove the ones you no longer use.
Keep your own backups: cPanel → Backup → download your Home Directory and MySQL databases at least once a month.
Contact us right away if you notice anything unusual, such as unknown admin users, strange pages, or your site not loading.
Sources
CloudLinux: PHP CVE-2026-109618 and CVE-2026-109619 package status and Imunify360 protection
SecurityOnline: cPanel PHP update fixes PHP2Shell and WP Toolkit flaws
Prothom Alo: Bangladesh Bank, land services and six banks' websites offline
Daily Sun: Bangladesh Bank website resumes after three-day shutdown