Critical PHP Vulnerabilities 2026: AEserver Update

On 21 October 2026, the PHP project disclosed two critical security vulnerabilities affecting millions of websites worldwide, including websites running WordPress, WooCommerce, Laravel and other PHP-based applications. Both vulnerabilities were rated 9.2 out of 10 (Critical) and could potentially allow attackers to execute malicious code on vulnerable web servers without authentication.

The vulnerabilities, known as PHP2Shell, triggered an emergency response across the global web hosting industry. Hosting providers, operating system vendors and security companies worked to protect their infrastructure while the official PHP patches were being released. Here is what happened, how AEserver responded, which customers may be affected and what you should do now.

What Is PHP and Why Does This Matter?

PHP is one of the most widely used programming languages on the internet. It runs the software behind millions of websites, including WordPress, online stores, booking systems, customer portals and business applications.

When someone visits a PHP-powered website, the server processes PHP code to generate the page or perform an action, such as submitting a contact form, logging in or placing an order.

Because PHP is used so extensively, a security vulnerability in the PHP engine itself can affect websites across thousands of hosting providers simultaneously.

This is different from a security issue in a specific WordPress plugin or theme. Even a fully updated WordPress website could be exposed if the underlying PHP runtime is vulnerable.

What Happened on 21 October 2026?

The PHP security team announced two critical vulnerabilities, identified as:

• CVE-2026-109618: A memory corruption vulnerability involving how PHP handles out-of-memory conditions and request cleanup.
• CVE-2026-109619: A vulnerability involving internal PHP state that may remain accessible after the underlying memory has been released.

Under certain conditions, attackers could exploit these vulnerabilities through specially crafted web requests, potentially gaining the ability to execute code without logging in or knowing a password.

Depending on the server configuration and permissions, a successful attack could allow an attacker to:

• Modify or delete website files.
• Install malicious scripts or backdoors.
• Access sensitive application data.
• Disrupt websites and online services.
• Potentially compromise other resources accessible to the affected PHP process.

Public information about the vulnerabilities and potential exploitation methods began circulating around the disclosure, increasing the urgency for website owners and hosting providers.

How the Web Hosting Industry Responded

With the vulnerabilities publicly disclosed and official security updates being prepared, hosting providers worldwide had to act quickly.

Different providers adopted different measures depending on their infrastructure. Some temporarily restricted website functions such as forms or file uploads. Others deployed emergency firewall rules, applied temporary configuration changes or prioritized the installation of patched PHP packages.

CloudLinux, a major provider of hosting operating system and security technologies, released emergency security updates for its PHP packages, including legacy PHP versions supported through its extended lifecycle products.

Imunify360 also deployed web application firewall rules designed to detect and block known attempts to exploit the vulnerabilities.

By 22 October, patched packages for CloudLinux Alt-PHP and cPanel EasyApache PHP were available through stable repositories. Some native operating system PHP packages were still being distributed.

The key point is that permanent PHP security patches are essential. Temporary firewall rules and configuration changes can reduce exposure, but they are not complete substitutes for applying the software fixes.

What AEserver Did to Protect Customers

At AEserver, our hosting infrastructure uses multiple layers of security, including CloudLinux and server-level protection technologies.

Our technical team was aware of the vulnerabilities before the official PHP security releases and implemented preventive measures on our hosting infrastructure to reduce exposure while waiting for the permanent fixes.

Following the release of the patches, our team began applying the updated PHP packages provided by our software vendors. Patched CloudLinux packages have been confirmed on customer hosting environments, including installations where the displayed PHP version number remains unchanged because the security fix was backported.

We continue to emphasize the importance of verifying the actual security patch level rather than relying only on the PHP version shown in a hosting control panel.

Our approach combines preventive measures, vendor security updates and ongoing maintenance, with the specific actions depending on the hosting platform and PHP configuration involved.

Which PHP Versions Are Affected?

According to the official PHP security advisory, PHP installations serving web requests may be vulnerable, including those using PHP-FPM, Apache, LiteSpeed and other PHP execution methods.

The PHP project released the following security updates on 21 October 2026:

PHP 8.2 will reach end of life on 31 December 2026. For better long-term security and application compatibility, we recommend moving to PHP 8.3 or PHP 8.4 where supported by your website.

Why Your PHP Version May Still Show an Older Number

This is an important detail for customers using CloudLinux.

CloudLinux sometimes delivers security fixes through backported packages. This means it applies the security patch to an existing PHP version without changing the version number displayed by PHP itself.

For example, a CloudLinux PHP installation may continue displaying PHP 8.3.35 while running a patched package that already contains the fixes for both vulnerabilities.

Therefore, seeing an older version number does not automatically mean your server remains vulnerable. The correct way to verify protection is to check the installed package release and the vendor’s security changelog.

What Should AEserver Customers Do Now?

The action you need to take depends on the type of hosting service you use.

Shared Web Hosting Customers

If your website is hosted on an AEserver shared hosting plan, server-level PHP package maintenance is handled by our technical team.

You do not need to manually install operating system updates or PHP security packages.

However, we recommend checking which PHP version your application uses and moving to a supported version when possible.

VPS and Dedicated Server Customers

If you operate a self-managed VPS or dedicated server, you or your server administrator are responsible for applying the required PHP security updates.

Install the fixed PHP packages from your operating system or control panel vendor and restart the relevant PHP services to ensure the patched code is running.

For managed server environments, update responsibilities depend on the scope of the management services included in your agreement.

Domain Name and Email-Only Customers

If you only use AEserver for domain registration, DNS or standard email hosting, these PHP vulnerabilities do not directly affect those services.

No PHP-related action is required unless you also operate a PHP-powered website or application.

How to Check Your PHP Version in cPanel

If you are using an AEserver Linux shared hosting plan, checking your PHP version is straightforward.

Visit my.aeserver.com and sign in using your registered account credentials.

Navigate to your active hosting service and open cPanel using the available login option.

Under the Software section, look for Select PHP Version or MultiPHP Manager, depending on your hosting configuration.

You can review the PHP branch currently selected for your website.

If your website uses an outdated PHP version, check that your application, plugins and themes support a newer version before changing it.

For most modern WordPress websites, PHP 8.3 or PHP 8.4 is a reasonable choice, provided all installed components are compatible.

Create a backup before making the change, test your website afterwards and check important functionality such as forms, login pages and checkout processes.

Frequently Asked Questions

Was my website hacked because of these vulnerabilities?

Not necessarily. The discovery of a vulnerability does not mean every affected website has been compromised.

However, if you notice unexpected website changes, unfamiliar files, suspicious administrator accounts or unusual server activity, investigate promptly and contact our support team.

Is WordPress affected?

WordPress uses PHP, so it may be exposed when running on a vulnerable PHP installation. The issue is not caused by WordPress itself, and updating WordPress alone does not fix the underlying PHP vulnerabilities.

Do I need to update PHP myself?

For AEserver shared hosting, server-level PHP package maintenance is handled by AEserver. Customers using self-managed VPS or dedicated servers must apply the appropriate updates themselves.

Can I continue using an older PHP version?

Some older PHP versions receive security backports from vendors such as CloudLinux and TuxCare. However, relying indefinitely on outdated PHP versions is not recommended.

Older applications should be reviewed and upgraded to supported PHP versions whenever possible.

Does a firewall or security plugin protect me?

Security tools such as Imunify360 can help block known attack patterns, but they cannot guarantee complete protection against these vulnerabilities.

Installing verified PHP security patches remains the recommended solution.

Should I be concerned about suspicious PHP update emails?

Yes. Major security announcements are often followed by phishing emails impersonating hosting providers.

Never enter your hosting password on an unfamiliar website or install software from an unverified link. Access your account directly through my.aeserver.com and confirm unexpected security notices with AEserver support.

PHP Security Checklist for Website Owners

Here is a quick checklist to help keep your website protected:

1. Check your PHP version through cPanel, Plesk or your server administration tools.
2. Verify that the security patch is installed, including vendor backports where applicable.
3. Upgrade unsupported PHP versions when your applications are compatible.
4. Keep WordPress and other applications updated, including plugins, themes and dependencies.
5. Maintain reliable backups before major application or PHP upgrades.
6. Review unusual website activity and report suspicious behavior promptly.
7. Be alert for phishing emails using this security incident as a pretext.

At AEserver, keeping our hosting infrastructure secure remains an ongoing priority. Security incidents like this demonstrate the importance of proactive protection, timely vendor updates and properly maintained websites.

If you have questions about your PHP version, hosting configuration or website security, visit our Support Center or contact our technical support team through the AEserver Client Area.

Official references: PHP Security Announcement, CloudLinux Security Update, and cPanel Security Advisory.