Critical PHP exploit patched

On the 21st of October 2026, a critical bug was discovered in the PHP scripting language. As soon as a patch was made available, we applied it to our hosting servers.

We operate 2 separate variants of PHP. We use the standard EA (Easy Apache) PHP from version 7.5 through to 8.5. For clients who require older versions of PHP for running legacy applications, we also support alt-PHP. This is hardened and designed to work well with CloudLinux.

We were notified of the exploit this AM, and a patch was applied as soon as it was released. Our alt-PHP patches did take some time to be released, but as each was made available, it was applied.

We have now successfully patched all versions of PHP that run on our service.

The exploit was known as “PHP2Shell”, a critical PHP vulnerability CVE-2026-109618 / CVE-2026-109619. In theory, a user could gain system access without authentication and gain privileges within accounts. We acted fast and addressed the issue as soon as possible.

This highlights why it is incredibly important to keep your website software up to date. There are always people looking for exploits. In this case, the exploit was extremely serious and affected almost 70% of the web.

This exploit was initially discovered by AI. An AI model was able to locate the exploit and discover how it could be used to gain system access. We should be thankful that the AI in question was being used by an ethical organisation who allerted PHP of the issue, who in turn generated a patch.

We always take security very seriously and will always ensure our servers are up-to-date and running secure versions of all applications and software.