Update: shared Linux website PHP fully patched for these vulnerabilities
Updated 22 October 2026. The EA-PHP and CloudLinux alt-PHP runtimes used by websites across our four shared Linux hosting servers have the vendor fixes for CVE-2026-109618 and CVE-2026-109619 installed. This is a statement about these two vulnerabilities on our shared Linux website platform, not a claim that every product or every other security issue is covered.
- EA-PHP and alt-PHP: vendor security updates have been installed, including backported fixes for older PHP branches. Checks of running website PHP workers confirmed they match the updated interpreter files, with both CVEs recorded in the corresponding package changelogs. Representative request-level checks have also been performed.
- Legacy website coverage: the remaining website configured for PHP 5.1 has been moved to the vendor-patched PHP 5.2 branch. Its served PHP version and website response were verified after the change. No shared Linux website remains configured for the uncovered PHP 4.4 or 5.1 branches identified in this review.
- Nameservers: the internal PHP used by the nameserver management software has the vendor fixes for both vulnerabilities installed.
- Windows hosting: PHP 8.2 and 8.3 website engines have been patched. Older Windows PHP handlers and the Windows hosting control panel's PHP engine remain outside this completed Linux rollout.
Scope: unused legacy packages and separate internal software are not being represented as fully patched by this website-runtime update. VPS and dedicated servers require service-specific confirmation and are not covered by the shared Linux completion statement.
Additional safeguards remain in place where applicable. They supplement the installed fixes; temporary configuration or firewall measures alone are not a complete patch.
You do not need an untested PHP version switch just because the displayed version number looks unchanged: vendor security backports can retain the same version number. Contact support through your Client Area if you need confirmation for your particular service.
Two critical security vulnerabilities have been disclosed in PHP, the software that runs WordPress and many other websites. They are tracked as CVE-2026-109618 and CVE-2026-109619, sometimes referred to as PHP2Shell.
In affected configurations, these vulnerabilities could allow an attacker to run unauthorised code on a server. Hosting Australia is applying available security updates and temporary safeguards across the hosting platforms covered by our response.
What we are doing
Our response includes:
- Applying vendor-supplied PHP security updates as they become available for each platform and installed PHP branch.
- Applying temporary PHP configuration safeguards to reduce exposure while updates are being released.
- Adding a targeted web firewall rule on our shared Linux hosting platform to block requests using PHP's session upload-progress field.
- Refreshing affected PHP processes and checking that updated software is actually serving requests.
- Testing representative website requests and ordinary uploads after changes.
Temporary safeguards reduce specific attack paths. They are not a replacement for the full PHP security updates, and we are not treating them as complete protection against both vulnerabilities.
Do I need to change my website's PHP version?
For websites on our shared hosting platforms, we handle the server-side security updates. You do not need to switch your PHP version just because you have seen a security alert.
Where the vendor provides a security fix for your existing PHP branch, we can apply it without switching your website to a different branch. This helps avoid unnecessary compatibility problems with older applications.
Some vendors backport security fixes into an existing version. This means a version shown in your control panel may look unchanged even though the underlying security package has been updated. The full vendor package release matters, not just the short PHP version number.
Older PHP branches should still be reviewed for a planned upgrade. A fix for these vulnerabilities does not make an older website or PHP branch secure against every other issue.
Will uploads or forms be affected?
Ordinary uploads are not being disabled. Our temporary safeguards target PHP's session upload-progress feature, rather than blocking all file uploads.
Applications using that particular feature may lose their progress indicator, and requests containing its associated field may be rejected. Other website upload mechanisms may be unaffected.
If a form or upload stops working, open a support ticket with:
- The affected page URL.
- The approximate time.
- The action you were attempting and any error displayed.
Do not disable security controls to work around the problem.
Does this mean my website has been hacked?
No. A vulnerability announcement does not establish that your website has been compromised. Equally, applying a patch does not prove that a website was never affected.
Report unexpected redirects, unfamiliar administrator accounts or unexplained website changes to support so they can be investigated.
What should I do now?
- Keep your website software, themes and plugins up to date, with a backup before changes.
- Avoid an untested PHP version switch in response to an alert.
- Contact support through your Client Area if you need your service's status checked or notice a problem.
VPS and dedicated servers: This article describes our shared-hosting response. If you operate a self-managed server, do not assume these changes have been applied to it. For managed servers, contact support to confirm the scope and status for your service.
