On October 21, 2026, the PHP development team released emergency security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both carry a CVSS 4.0 score of 9.2 and both allow an unauthenticated attacker to run code on a vulnerable server with nothing more than a crafted HTTP request. Because the flaws are in PHP itself, not in any particular application, every PHP site was affected regardless of how clean its own code was.
Every one of our managed servers was patched by 9:27 PM Eastern that same day. More importantly, we had multiple layers of protection in place throughout the incident, including measures we put in place before PHP’s official fixes were released.
We published a status notice throughout the day as events unfolded. This post is the longer version: what the vulnerabilities actually were, what we did before the patches existed, why there was a gap between the PHP release and our ability to install it, and a clean timeline of the day.
Continue reading “PHP2Shell: How MDDHosting Responded to the Critical PHP Security Vulnerabilities”