Status: Security Patches Deployed | Severity: CRITICAL | CVSS Score: 9.2/10

We are pleased to announce that HostFe has completed the deployment of critical PHP security patches across our hosting infrastructure, addressing two recently disclosed vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619, collectively known as "php2shell."

These vulnerabilities were officially disclosed by the PHP Security Team on 21 October 2026 and carry a critical severity rating of 9.2 under CVSS v4.0.

Understanding the Security Threat

The vulnerabilities could allow unauthenticated attackers to execute malicious code remotely on affected PHP environments.

• CVE-2026-109618: Remote Code Execution (RCE) resulting from memory corruption during out-of-memory handling.

• CVE-2026-109619: Remote Code Execution (RCE) caused by stale internal PHP state being reused across requests.

Both vulnerabilities potentially affect PHP-based websites and applications, including environments running Apache, PHP-FPM, LiteSpeed and other supported PHP execution handlers.

Immediate Security Actions Taken by HostFe

As part of our proactive infrastructure security strategy, HostFe implemented the following measures:

• Critical Security Patching: Deployed the applicable vendor security updates across HostFe hosting servers.

• Early Preventive Hardening: On 20 October 2026, HostFe proactively disabled session.upload_progress.enabled as an additional precaution against known exploitation methods.

• PHP Security Updates: Applied applicable security releases and vendor-maintained backported fixes for supported PHP environments.

• Security Protection: Continued enforcement of server-level security policies, web application firewall protections and threat detection mechanisms.

• Infrastructure Monitoring: Continued monitoring for suspicious activity and potential exploitation attempts.

The PHP Security Team has confirmed that disabling session upload progress mitigates certain known attack paths but does not eliminate every possible exploitation method. Installing the security updates remains the only complete solution.

PHP Security Release Versions

The PHP project released the following patched versions on 21 October 2026:

For older PHP environments, security coverage depends on the operating system and PHP package provider. cPanel has released backported fixes for EA-PHP 7.4, 8.0 and 8.1, while CloudLinux is providing security updates for its ALT-PHP branches.

Customers using legacy PHP versions are strongly encouraged to migrate to currently supported releases wherever possible.

Do HostFe Customers Need to Take Action?

No immediate server-level action is required for customers using HostFe-managed shared, cloud or reseller hosting services covered by this update.

However, customers should continue following security best practices:

• Keep WordPress, plugins, themes, and other PHP applications updated.

• Upgrade outdated PHP versions whenever application compatibility permits.

• Remove unused or unsupported scripts.

• Maintain independent backups of important website data.

Customers operating self-managed dedicated servers remain responsible for verifying and applying updates within their own operating systems.

Our Commitment to Hosting Security

At HostFe, we believe that reliable hosting starts with a secure infrastructure.

Our engineering team continuously monitors emerging vulnerabilities, coordinates security updates and implements preventive safeguards to protect the websites and applications hosted on our network.

Official Security References

• PHP Official Security Advisory

• CVE-2026-109618

• CVE-2026-109619

Published: 22 October 2026
Category: Security Updates / Infrastructure Announcements

HostFe Security & Infrastructure Team

HostFe is issuing an important security advisory following a confirmed security incident involving TeamUpdraft, the developer of the widely used WordPress backup plugin UpdraftPlus and its remote management platform, UpdraftCentral.

Between October 17 and 19, 2026, unauthorized access to TeamUpdraft's infrastructure potentially exposed sensitive account information and UpdraftCentral connection keys.

Security researchers subsequently identified attackers exploiting compromised connection keys to remotely install malicious plugins, create unauthorized WordPress users, and establish persistent backdoor access to affected websites.

All HostFe customers using UpdraftPlus or UpdraftCentral are strongly advised to review their WordPress installations and take immediate precautionary action.

What Happened?

UpdraftCentral allows WordPress administrators to remotely manage websites, perform updates, install plugins, and execute administrative tasks through authenticated connections.

Following the reported security breach, attackers obtained access to valid connection keys and used them to send unauthorized commands to connected WordPress websites.

These attacks could allow malicious actors to:

• Install unauthorized plugins containing malicious code.

• Create hidden or unauthorized WordPress user accounts.

• Obtain administrative capabilities without normal authentication.

• Maintain persistent access to compromised websites.

• Modify website files, configurations, or stored information.

Importantly, this incident concerns compromised remote management credentials rather than a vulnerability in the UpdraftPlus plugin code itself.

TeamUpdraft has confirmed that its official plugin downloads and self-hosted UpdraftCentral installations were not affected by this incident.

Immediate Security Actions Required

HostFe recommends that customers complete the following security checks immediately.

1. Update UpdraftPlus

Access your WordPress dashboard and navigate to Plugins → Installed Plugins.

Ensure UpdraftPlus is updated to at least:

• UpdraftPlus Free: Version 1.26.13

• UpdraftPlus Premium: Version 2.26.13

Install any newer security releases available.

These updates revoke affected older UpdraftCentral connections, helping prevent unauthorized commands through the compromised keys.

2. Remove Existing UpdraftCentral Connection Keys

Navigate to:

WordPress Dashboard → Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral

Locate Manage existing keys and remove any existing connection keys.

Even if you do not actively use UpdraftCentral, verify that no connection keys are stored.

Removing UpdraftCentral connections does not disable the normal UpdraftPlus backup functionality.

3. Inspect WordPress Users

Navigate to Users → All Users and carefully review all accounts.

Pay particular attention to unfamiliar Administrator or Editor accounts. Security researchers have identified malicious accounts disguised as ordinary Editors while possessing elevated administrative capabilities.

Remove unauthorized accounts after preserving relevant evidence and verifying that they are not legitimate users.

4. Inspect Installed Plugins

Review all installed WordPress plugins, including Must-Use plugins and any recently added files.

Researchers have identified suspicious plugins using names such as Site Health Cache, alongside numerous other randomly generated plugin names.

Investigate unfamiliar plugins, especially those installed between October 18 and 19, 2026.

5. Reset Passwords and Review Sessions

Change passwords for WordPress administrators and your TeamUpdraft account.

Where appropriate, reset two-factor authentication, terminate existing sessions, and review other credentials accessible to the website.

6. Scan Your Website for Malware

Perform a comprehensive security assessment of your WordPress installation.

If suspicious activity is identified, isolate the affected website and investigate the extent of the compromise.

Important: Updating UpdraftPlus does not automatically remove malicious plugins or unauthorized accounts that attackers may have installed before the connection keys were revoked.

7. Restore From a Verified Clean Backup if Necessary

If your website has been compromised, consider restoring it from a verified clean backup created before October 17, 2026.

After restoration, apply the latest security updates, revoke old connection keys, rotate affected credentials, and confirm that the website is clean before returning it to normal operation.

Additional Advisory for UpdraftVault Users

TeamUpdraft has also reset UpdraftVault connections as a precaution.

Customers using UpdraftVault should reconnect their remote backup storage and verify that scheduled backups are functioning correctly.

Customers relying on UpdraftClone should also review the vendor's instructions for replacing affected client keys.

HostFe Security Advisory

At HostFe, protecting hosting infrastructure and customer websites remains a key priority.

We strongly encourage all customers to maintain updated WordPress installations, regularly review administrative access, monitor installed plugins, and maintain independent, verified backups.

Please note: This is a third-party security incident involving TeamUpdraft and does not, by itself, indicate a compromise of HostFe's hosting infrastructure.

Customers who identify unauthorized plugins, unfamiliar administrator accounts, or unexpected website modifications should immediately contact HostFe Technical Support through their client area.

Official Security References

TeamUpdraft Security Incident Disclosure:
https://teamupdraft.com/blog/security-incident-october-2026/

Patchstack Security Research:
https://patchstack.com/articles/updraftcentral-key-compromise-wordpress-backdoors/

HostFe Security Team