Security Notice: Critical PHP Vulnerabilities (PHP2Shell) - Updated October 22, 2026

Security Notice: Critical PHP Vulnerabilities (PHP2Shell) - October 21, 2026

Update (October 22, 2026): Every PHP version that has received a fix (PHP 8.2 and newer) is now updated on all of our servers, including our billing system, client area and the Plesk control panel. If your website uses PHP 8.2 or newer, it is protected and you do not need to do anything. The temporary 256 MB upload limit in the Plesk control panel has been lifted. Please see the details below if your website still uses PHP 7.4, 8.0 or 8.1.

Dear Valued Customer,

On October 21, 2026 the PHP project released emergency security updates for two critical vulnerabilities in PHP, known as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619). They affect PHP 5.4 and every later version and can let an attacker run code on a server without logging in. We want to let you know what we have done and what it means for you.

What We Have Done:

• We have installed the updated PHP versions (8.2.35, 8.3.36, 8.4.27 and 8.5.12) on our Windows hosting servers.
• Our billing system and client area run on the updated PHP versions. They are also only reachable through our web application firewall provider, which has deployed protection rules against these attacks.
• The Plesk control panel, which uses its own copy of PHP, has been updated to the fixed version.
• For websites that still use PHP 7.4, 8.0 or 8.1, we have applied the recommended protective setting. These versions cannot be fully protected (see below).

What This Means for You:

• Websites built with ASP.NET or ASP.NET Core do not use PHP and are not affected.
• If your website uses PHP 8.2 or newer (for example WordPress), you do not need to do anything for these vulnerabilities. As always, please keep your application, themes and plugins up to date.
• PHP 7.4, 8.0 and 8.1 no longer receive official security fixes from the PHP project, and no fix for these vulnerabilities has been released for them. If your site still uses one of these versions, we strongly recommend switching it to PHP 8.2 or newer in Plesk (in your domain's PHP settings) after checking that your site works with the newer version.

If you have any questions, please open a support ticket and our team will be happy to help.

Thank you for choosing Adaptive Web Hosting.