PHP2Shell: How Pofii Handled This Week’s Critical PHP Vulnerabilities

This week the PHP world had one of its most serious security incidents in years. Here’s what happened, and how we kept your websites protected.

What happened

On 20 October 2026, details of two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619 (nicknamed “PHP2Shell”), leaked online before an official fix existed. Both are rated 9.2 out of 10, and both could allow remote code execution on a web server without any login.

What made PHP2Shell unusual is where the flaws lived: in the PHP engine itself, not in WordPress, a plugin or any particular application. Any server running an unpatched PHP version was potentially exposed, no matter how well the website on it was built. Security firms reported early exploitation attempts within hours of the leak.

What we did

We started early. As soon as PHP published its advance warning, we began preparing our infrastructure and applying protective configuration ahead of the official fix.

We patched as soon as fixes arrived. PHP released the patched versions on 21 October, and we rolled them out across the Hostoa platform the same day, restarting every PHP process and verifying the live versions site by site.

We didn’t wait on slower vendors. On our pPanel Legacy servers, the patched LiteSpeed PHP builds arrived later than the official release. Sites waiting on those builds were temporarily moved to NGINX, and once LiteSpeed published its patched builds, we applied those as well, including the PHP that runs the control panel itself.

Where things stand

All Pofii infrastructure now runs patched PHP, and no compromise has been reported. No action is required from our customers.

One recommendation

PHP 8.1 and older no longer receive regular security updates from the PHP project. For this incident we used vendor rebuilds that include the fixes, but the long-term answer is a supported version. If your site still runs PHP 8.1 or older, we recommend switching to PHP 8.3 in your control panel, or contacting us and we’ll help you move.

Thank you

Incidents like this are exactly why managed hosting exists. While much of the web scrambled overnight, our team handled it so you didn’t have to.

If you have any questions, our support team is always here to help.

— The Pofii Team

---