Ultra Web Hosting servers are fully patched against the October 2026 PHP remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619, often called "php2shell". Every affected server across our shared, reseller, and managed WordPress fleet was updated and verified on October 21, 2026, and our web application firewall was already blocking the known exploit before the vendor fix shipped. If you are on one of these plans, no action is required.
All Ultra Web Hosting shared, reseller, and managed WordPress servers are patched against CVE-2026-109618 and CVE-2026-109619. The fix was applied in place as a backported build of your existing PHP version, so your PHP version string did not change and your sites kept running without downtime. On top of the patch, our ModSecurity and Imunify360 web application firewall rules block the circulating exploit. You do not need to do anything.
01. What CVE-2026-109618 and CVE-2026-109619 are
In October 2026, security researchers disclosed a pair of critical vulnerabilities in the PHP interpreter, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "php2shell". Both carry a CVSS severity score of 9.2 (Critical).
In plain terms, the flaws let an attacker who sends a specially crafted HTTP request to a vulnerable PHP application run their own code on the server. No login or valid account is needed, which is what makes this class of bug (unauthenticated remote code execution, or RCE) so serious.
- CVE-2026-109618 - a memory corruption flaw triggered by crafted multipart form and file-upload requests.
- CVE-2026-109619 - a use-after-free flaw in PHP's session upload-progress feature, reachable over the same upload path.
The PHP project shipped corrected releases: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP 8.0 and 8.1 are end of life and do not receive a fix. Apache with mod_php is at the highest risk; PHP-FPM and LSAPI setups are affected in some configurations.
An unauthenticated RCE in the language that runs most of the web is the kind of flaw attackers race to weaponize. A public exploit tool began circulating within hours of disclosure, which is exactly why we combined an immediate firewall block with a same-day patch rather than waiting.
02. Who is affected
The vulnerability lives in the PHP interpreter itself, so in principle any unpatched server running an affected PHP version is exposed, regardless of which application sits on top of it (WordPress, Laravel, custom PHP, and so on). What matters for you is whether the server was patched.
Ultra Web Hosting shared, reseller, and managed WordPress
Fully patched and verified on October 21, 2026, with WAF rules blocking the known exploit. Nothing for you to do. This is the great majority of our customers.
Unmanaged VPS and dedicated servers
You control PHP updates on an unmanaged server, so patching is your responsibility. See section 06 for how to confirm and update.
03. How Ultra Web Hosting responded
Security patching on our shared and managed infrastructure is centralized, so our customers were covered without lifting a finger. Here is the timeline for these specific CVEs, which is typical of how we handle any critical flaw:
- Immediate WAF protection - our web application firewall ruleset was updated the same day to block the circulating exploit, giving every site a safety net during the short window before the vendor patch was ready.
- In-place patch - the fix arrived as a backported, security-rebuilt version of each PHP release we run. Because it is the same version number with the security fix merged in, your PHP version did not change and nothing about your site needed adjusting.
- Fleet-wide rollout - every affected server was updated, not just one, and the PHP workers were recycled so they immediately ran the corrected binary.
- Verification - we confirmed on each server that the patched build was installed, by checking the security-fix changelog entry referencing CVE-2026-109618, not just the version number.
You may read online that you need "PHP 8.3.36 or later" to be safe. On an enterprise Linux platform like ours, the fix is backported into the version already running, so a patched server can correctly report, for example, PHP 8.3.35 while being fully protected. The patch is identified by its security changelog, not by a jump to the upstream version number. The short version: your server is patched even if the version string looks unchanged.
04. The WAF layer and why it matters
Every Ultra Web Hosting server runs a web application firewall built on ModSecurity with the Imunify360 rulesets. For these CVEs the firewall did two useful things:
- Blocked the known exploit path - the publicly circulating exploit tool targets the session upload-progress upload path, which is signature-able. Updated WAF rules reject those malicious requests before they reach PHP.
- Bought time safely - because the rules shipped the same day the vulnerability went public, sites were protected against the real-world exploit during the brief window before the interpreter patch itself was applied.
A WAF rule is not a substitute for patching, and we never treat it as one. It is a layer in front of the fix. For these CVEs you now have both: the underlying PHP patch and the firewall rules on top of it. Learn more in Firewall and Security Protection.
05. What you need to do
On shared, reseller, and managed WordPress hosting, nothing. The server-level patch and the firewall rules are ours to manage and are already in place.
There is one distinction worth understanding. A server-level PHP patch protects the shared software stack. It does not fix a vulnerability inside your own website code. So while you do not need to patch PHP, you should still:
- Keep WordPress core, plugins, and themes up to date, and remove anything you no longer use.
- If you suspect a site was already compromised before patching, follow How to Fix a Hacked WordPress Site.
- Review the WordPress Security hardening guide for defense in depth.
06. VPS and dedicated servers
On an unmanaged VPS or dedicated server you have root access and full control, which means PHP and operating system patching is yours to manage. To confirm and update:
- Update your packages:
yum update(CloudLinux, AlmaLinux, CentOS) orapt upgrade(Ubuntu, Debian), then restart your web server or PHP-FPM so workers run the new binary. - If you use cPanel, its automatic update system handles the EasyApache PHP builds, but you still own the base operating system and any custom PHP installs.
- Confirm the fix landed by checking the package changelog for a CVE-2026-109618 entry rather than relying only on the version number.
- Not sure whether your plan is managed or unmanaged? Open a ticket and we will confirm and tell you exactly what, if anything, is on your plate.
07. Frequently asked questions
Are Ultra Web Hosting servers patched against CVE-2026-109618 and CVE-2026-109619?
Yes. Every shared, reseller, and managed WordPress server was patched and verified on October 21, 2026, and our web application firewall blocks the known exploit. No customer action is required on these plans.
Do I need to update my PHP version to be safe?
No. On our managed infrastructure the security fix is backported into the PHP version you already run, so your version string does not change and there is nothing to select or update. The patch is identified by its security changelog entry, not by a jump to a new version number.
A scanner flagged my site for CVE-2026-109618. Is it a false positive?
If you are on our shared, reseller, or managed WordPress hosting, yes, it is almost certainly a false positive caused by the scanner reading the PHP version string instead of the patched build. The vulnerability is fixed on the server. If you want human confirmation, open a support ticket.
What are CVE-2026-109618 and CVE-2026-109619?
They are a pair of critical PHP vulnerabilities disclosed in October 2026, nicknamed "php2shell", with a CVSS score of 9.2. They allow unauthenticated remote code execution through crafted multipart upload requests and a use-after-free in PHP's session upload-progress feature.
Was my website compromised?
The server-level patch and firewall rules prevent exploitation going forward. They do not retroactively undo any compromise that may have happened before patching. If you see signs of a hacked site, follow our guide on how to fix a hacked WordPress site and open a ticket so we can help investigate.
Is My Server Patched Against Security Vulnerabilities? - Firewall and Security Protection - WordPress Security: The Complete Hardening Guide - How to Fix a Hacked WordPress Site
Still want us to confirm?
If you have read this and still want a human to confirm your server is patched against these CVEs, open a ticket and we will verify it for you.
Open a Support TicketQuick Recap
If you only remember a few things from this guide:
- Our servers are patched against CVE-2026-109618 and CVE-2026-109619, verified October 21, 2026.
- WAF rules block the known exploit, and shipped the same day the flaw went public.
- No action is required on shared, reseller, or managed WordPress plans.
- Your version string may look unchanged and still be patched, the fix is backported into your existing PHP version.
- Unmanaged VPS and dedicated owners patch their own server, open a ticket if you are unsure which you have.
Last updated October 2026 · Browse all General articles
