Status: Security Patches Deployed | Severity: CRITICAL | CVSS Score: 9.2/10

We are pleased to announce that HostFe has completed the deployment of critical PHP security patches across our hosting infrastructure, addressing two recently disclosed vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619, collectively known as "php2shell."

These vulnerabilities were officially disclosed by the PHP Security Team on 21 October 2026 and carry a critical severity rating of 9.2 under CVSS v4.0.

Understanding the Security Threat

The vulnerabilities could allow unauthenticated attackers to execute malicious code remotely on affected PHP environments.

• CVE-2026-109618: Remote Code Execution (RCE) resulting from memory corruption during out-of-memory handling.

• CVE-2026-109619: Remote Code Execution (RCE) caused by stale internal PHP state being reused across requests.

Both vulnerabilities potentially affect PHP-based websites and applications, including environments running Apache, PHP-FPM, LiteSpeed and other supported PHP execution handlers.

Immediate Security Actions Taken by HostFe

As part of our proactive infrastructure security strategy, HostFe implemented the following measures:

• Critical Security Patching: Deployed the applicable vendor security updates across HostFe hosting servers.

• Early Preventive Hardening: On 20 October 2026, HostFe proactively disabled session.upload_progress.enabled as an additional precaution against known exploitation methods.

• PHP Security Updates: Applied applicable security releases and vendor-maintained backported fixes for supported PHP environments.

• Security Protection: Continued enforcement of server-level security policies, web application firewall protections and threat detection mechanisms.

• Infrastructure Monitoring: Continued monitoring for suspicious activity and potential exploitation attempts.

The PHP Security Team has confirmed that disabling session upload progress mitigates certain known attack paths but does not eliminate every possible exploitation method. Installing the security updates remains the only complete solution.

PHP Security Release Versions

The PHP project released the following patched versions on 21 October 2026:

For older PHP environments, security coverage depends on the operating system and PHP package provider. cPanel has released backported fixes for EA-PHP 7.4, 8.0 and 8.1, while CloudLinux is providing security updates for its ALT-PHP branches.

Customers using legacy PHP versions are strongly encouraged to migrate to currently supported releases wherever possible.

Do HostFe Customers Need to Take Action?

No immediate server-level action is required for customers using HostFe-managed shared, cloud or reseller hosting services covered by this update.

However, customers should continue following security best practices:

• Keep WordPress, plugins, themes, and other PHP applications updated.

• Upgrade outdated PHP versions whenever application compatibility permits.

• Remove unused or unsupported scripts.

• Maintain independent backups of important website data.

Customers operating self-managed dedicated servers remain responsible for verifying and applying updates within their own operating systems.

Our Commitment to Hosting Security

At HostFe, we believe that reliable hosting starts with a secure infrastructure.

Our engineering team continuously monitors emerging vulnerabilities, coordinates security updates and implements preventive safeguards to protect the websites and applications hosted on our network.

Official Security References

• PHP Official Security Advisory

• CVE-2026-109618

• CVE-2026-109619

Published: 22 October 2026
Category: Security Updates / Infrastructure Announcements

HostFe Security & Infrastructure Team