🛡️ Security Announcement: Critical PHP Vulnerabilities (PHP2Shell) & Infrastructure Patching

CURRENT STATUS: 🟢 WAF PROTECTED — PATCH ROLLOUT IN PROGRESS (Last Updated: 03:00 UTC, Oct 22, 2026)

Our Systems Administration team has successfully tested the security patches and is rolling them out across all servers. No incidents have been reported across our infrastructure.

The PHP Development Group recently disclosed two critical memory-safety Remote Code Execution (RCE) vulnerabilities—collectively referred to as PHP2Shell (CVE-2026-109618 and CVE-2026-109619)—affecting core PHP request processing engines across the web.

Below is an overview of the vulnerability, the actions HostWP.io is taking to secure your infrastructure, and recommended steps for your application.

🔍 Vulnerability Details

Both CVEs relate to how the PHP engine handles memory allocations during Out-Of-Memory (OOM) conditions:

• CVE-2026-109618 (Remote Code Execution via OOM Corruption): An OOM failure during internal request initialization interrupts execution, causing cleanup routines to process corrupted data structures.
• CVE-2026-109619 (Remote Code Execution via Stale Global State): Internal process pointers persist after memory is freed post-OOM, allowing subsequent requests handled by the same worker process to exploit stale memory states.

Because these flaws reside within the core PHP runtime, unpatched PHP environments across PHP 8.x, 7.x, and legacy builds are potentially vulnerable if an attacker triggers an OOM condition.

🚨 Active Server Mitigations (What HostWP.io Is Doing)

Our Systems Administration team responded immediately upon disclosure. At HostWP.io, our server infrastructure is powered and secured by CloudLinux OS, an enterprise-grade platform specifically designed to isolate hosting accounts and deliver hardened PHP environments (alt-PHP and ea-PHP).

Here is what our team is doing to protect your websites:

• CloudLinux Account Isolation (ACTIVE): CloudLinux LVE technology strictly isolates every account into its own secure virtual container. This prevents memory states, scripts, or worker processes from leaking across accounts or affecting other websites on the server.
• Active WAF & Exploit Filtering (ACTIVE): Updated Web Application Firewall (WAF) and Imunify360 security rulesets are actively filtering all incoming traffic, automatically blocking known exploit request patterns and malicious payload signatures.
• Successful Patch Testing & Server Rollout (IN PROGRESS): As CloudLinux releases fixed binaries for alt-PHP and ea-PHP across all PHP versions (PHP 5.2 through 8.5), our SysAdmin team has successfully tested them and is actively deploying the updates across all server nodes.

✅ Good News: Zero Incidents Reported

We are pleased to share that none of our customers have reported any security incidents or issues on their end. Thanks to our proactive WAF rules and CloudLinux containment, your websites have been safely shielded from the moment this vulnerability was disclosed.

We truly appreciate your patience and trust as our Systems Administration team completes the rollout of these updates across all PHP versions on all servers.

Service Impact: All security rules and PHP runtime updates are applied dynamically in the background without requiring server reboots or causing downtime. You do not need to take any action on your account.

📋 Suggested Actions for You

While our team secures the underlying PHP runtimes, we advise you to verify your website environments:

1. Check Your Active PHP Version: Log into cPanel (Select PHP Version) and ensure your websites run on PHP 8.2, 8.3, or 8.4. If your site still uses legacy PHP (PHP 7.4 or earlier), plan an upgrade to PHP 8.x to remain on actively supported security branches.
2. Keep Everything Updated: Ensure your WordPress core, active themes, and plugins are fully updated to prevent memory leaks or fatal errors that attackers could target.

💬 Questions & Support

Our SysAdmin and Technical Support teams are monitoring servers health around the clock. If you have questions regarding your website’s PHP configuration or wish to verify your site’s security status:

• Open a Support Ticket: Log in at platform.hostwp.io