You may have seen news this week about two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell”). Here’s a quick summary and where your website stands.
What happened
These flaws are in PHP itself, the programming language behind WordPress and most websites. They are not specific to WordPress or any one plugin. Left unpatched, they could let an attacker run their own code on a web server without logging in. The PHP project released fixes on October 21, 2026.
Where your site stands
We've applied the official PHP security updates across its platforms and had additional firewall protections in place before the updates were released. For most websites, no action is needed. If action is needed, we will reach out.
How we handle this
Server-level PHP patching is implemented and verified. Then, we monitor and scan hosted websites for suspicious changes, keep WordPress core, plugins and themes updated, and watch for new vulnerability alerts so we can respond quickly. No single tool prevents every attack, which is why we use several layers.
Is your site running an older version of PHP?
We strongly recommend upgrading older versions of PHP to a currently supported version. PHP 8.2 stops receiving security fixes on December 31, 2026, so sites on 8.2 should plan to upgrade soon as well.
Our WordPress Hosting service includes Plugin and WordPress Core updates, as long as your site’s plugins, theme, and custom code are compatible with the newer version. PHP updates, older plugins, and themes need a closer look before an upgrade, and in those cases we’ll review the options with you first. We back up your site and test before making a change so your site keeps running smoothly.
What to do next?
Please submit a support ticket titled “PHP upgrade request” with your website address.
Tickets can be entered at https://support.higherimages.com
If you’re not sure which PHP version your site uses, just say so and we’ll check for you. We’ll confirm your current version, review compatibility, and schedule the upgrade.
A caution about phishing
Scammers often exploit news like this by sending fake emails asking people to log in or click a link. If you get an unexpected email about this vulnerability, please don’t click anything, and reach out through our support portal if you need to check it.
Thank you for trusting us with your website.
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article