A pair of critical, remotely exploitable vulnerabilities — CVE-2026-109618 and CVE-2026-109619, dubbed "PHP2Shell" — was disclosed in PHP's emergency security release of 21 October 2026. Both allow unauthenticated attackers to execute arbitrary code on affected web servers (CVSS 9.2 – Critical). CISA has added both to its Known Exploited Vulnerabilities catalog and urges immediate patching; active exploitation and leaked exploit details are already reported in the wild.
The flaws affect PHP 5.4 and later, but fixes exist only for supported PHP 8.x branches. End-of-life versions (PHP 5.x, 7.0–7.4) will never receive a patch and remain permanently exposed.
1. What We Are Doing
As your hosting provider, your security is our highest priority. Our team has launched a full security audit of every server in our infrastructure: verifying and patching all supported PHP versions, reviewing PHP/PHP-FPM configurations, and scanning for signs of compromise. Given the number of servers in our fleet, this audit is being done manually, server by server, and will take several days to complete properly. We appreciate your patience — we will not rush this process.
2. Request a Priority Vulnerability Audit
Want your server checked ahead of the fleet audit?
Email: support@webji.services — Subject: PHP Vulnerability Audit Request
Our team will review your server manually and place it in the priority queue. An audit alone is not a fix — please also follow the steps in Section 4 immediately.
3. Critical Notice for Customers on Outdated PHP
Many customers run applications on end-of-life PHP 5.x or 7.x because the code has not been updated by their developer in years.
We must be direct:
1. No patch exists or will ever exist for these versions (PHP 5.x EOL January 2019; PHP 7.x EOL November 2022). The current vulnerabilities cannot be fixed on them.
2. Your server is at serious, ongoing risk of hacking and full compromise — attackers are actively scanning for these versions right now.
3. We cannot secure your application on these versions. The only remedy is for your developer to update your code to a supported PHP 8.x version — application-level work only your developer can perform. Treat this as an emergency and engage them today.
4. Recommended Steps (Act Now)
1. Identify your PHP version (via your developer or control panel).
2. On PHP 8.1–8.4? Confirm you're on the latest patched release and email support@webji.services for your priority audit.
3. On PHP 5.x/7.x or any EOL version? Instruct your developer to upgrade to supported PHP 8.x immediately — every day of delay is exposure.
4. Update your CMS, themes, and plugins to current versions.
5. Take a full backup of files and databases now, before changes.
Don't wait for the audit to begin — the audit confirms status; the upgrade protects you.
5. Support & Restoration Policy for Outdated Versions
Customers who continue running outdated, end-of-life PHP or any unpatched, security-vulnerable software do so entirely at their own risk. In the event of a hack, data loss, malware, or any security incident on such servers, we will be unable to provide free restoration, recovery, or related support.
Statement of Client Self-declaration of risk for using outdated PHP versions (if you decide not to update your codes to work with the latest php versions)
"I hereby confirm that I have been made aware by the Webji team that my website(s) operate on an insecure, end-of-life PHP version(s). I understand that by continuing to run outdated PHP versions, my server remains at risk, and that Webji is not responsible for any outcomes arising from this security risk. I will maintain and manage offsite backups of my data myself. I further agree that any administrative time required for incident response, cleanup, or restoration on such server(s) will be billable at Webji's standard admin-time fees, and I will bear these charges in full should such a situation arise."
Any admin time for incident response, cleanup, or restoration on such servers will be billable at our standard admin-time fees, at the customer's expense.
6. Terms of Service Reminder
As stated in our Terms of Service at https://webji.in/terms-of-service use of outdated, end-of-life, or security-vulnerable software — including outdated PHP versions — is not permitted on our servers. Customers are contractually responsible for keeping applications and PHP versions current and supported.
Questions or assistance: support@webji.services. Fleet-wide audit is ongoing and expected to complete within several days. Security is a shared responsibility — we're handling the infrastructure; please ensure your application code is equally current.
