If your website is hosted with Instilled, you’re already protected: we upgraded every one of our servers to the latest secure version of PHP as soon as the fixes were released.
On Wednesday 21 October, the team behind PHP released urgent security updates for two critical flaws. PHP is the programming language that powers a huge number of websites, including every WordPress site and the UK’s National Cyber Security Centre (NCSC) has urged website owners to act immediately.
What happened
Two separate bugs were found deep inside PHP itself, not in any particular plugin or theme. Security researchers have nicknamed them “PHP2Shell”.
- CVE-2026-109618 – if PHP runs out of memory at exactly the wrong moment, it can leave behind half-finished data that it later treats as valid. A carefully crafted request can turn this into a way to run code on the server.
- CVE-2026-109619 – after certain errors, PHP can keep hold of information from a previous visitor’s request. The next request handled by the same process can then misuse it, again opening the door to running code.
The PHP Foundation rates both as critical (CVSS 9.2). Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older, unsupported versions (8.1 and earlier) are not officially patched, although our servers have also backported fixes to these versions.
Why it matters
These flaws could let an attacker take control of a web server without ever logging in. In some common setups, a single request is enough, before your website’s own code even runs.
That means a strong password or a well-maintained set of plugins won’t stop it on their own. The fix has to happen at the server level.
This isn’t theoretical, either. Help Net Security reports that a working exploit exists, and Amazon’s threat researchers saw an attack attempt four days before the fix was made public.
If we host your website
You don’t need to do anything. All Instilled hosting servers have been upgraded to the latest patched PHP releases.
- Your website has stayed online and should look and work exactly as before.
- We’re continuing to monitor our servers for any signs of suspicious activity.
- We’ll apply any further PHP updates as soon as they’re released.
If you notice anything unusual on your site, let us know, and we’ll take a look straight away.
If your website is hosted elsewhere
Please contact your hosting provider as soon as possible and ask them three questions:
- Have your servers been updated to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a patched equivalent)?
- If my site is on an older version of PHP, is it protected, and when will it be upgraded?
- Are you checking for any signs that sites were attacked before the update?
The NCSC advises that any system which can’t be patched or protected quickly should be taken offline until it can be. If you don’t get a clear answer from your host, or you’re not sure who hosts your site, get in touch, and we’ll help you check.
Need help?
Keeping our clients’ websites secure is a core part of what we do, and we act quickly when issues like this come up. Whether you’re hosted with us or not, if you have questions about this update or want us to check your site, get in touch with the Instilled team.
