Hostinger deploys protections against php2shell PHP vulnerabilities
Updated October 22, 07:20 UTC: PHP’s fix is now installed on all Hostinger hosting servers except VPS, which customers manage themselves. For live status, see our status page.
On October 21, the PHP project fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now known as php2shell. Both are rated 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS). Details leaked before the planned release, and exploit code for one of them was already circulating before the fix was out. We blocked the exploit attempts already circulating in advance, and we’ve rolled out PHP’s update across our platform.
In short:
- Every Hostinger hosting plan except VPS: nothing to do. We manage PHP on these plans and have taken care of it: the circulating exploit did not work against our servers, our firewall rules blocked requests that match the attack, and we’ve installed PHP’s fix on every server.
- VPS: if you manage PHP on your own server, update it and restart it now. The steps are below.
What we know about the vulnerabilities
Both bugs come down to how PHP cleans up memory when a request goes wrong. In the worst case, an attacker could run their own code on a server, read data they shouldn’t see, or take a site down.
| Vulnerability | What goes wrong |
| CVE-2026-109618 | A request pushes PHP to its memory limit at exactly the wrong moment. PHP stops halfway, leaves some data half-built, and later treats it as if it were complete. |
| CVE-2026-109619 | An error interrupts a request, and PHP holds onto memory that has already been freed. The next request handled by the same process can then reach that leftover memory. |
Every PHP version before 8.5.12, 8.4.27, 8.3.36, and 8.2.35 is affected, going back at least to PHP 5.4. That covers WordPress, WooCommerce, Magento, and most other PHP sites.
Because the flaw is in PHP itself, updating WordPress, themes, or plugins won’t fix it. Only a patched PHP does.
What we’ve done
First, we blocked the attacks already doing the rounds. We added security rules that catch known exploit patterns and updated our firewall rule set, which reaches every server running ModSecurity automatically. The rules run in deny mode, so any matching request is rejected by the server immediately.
We also switched off session.upload_progress on our LiteSpeed, PHP Selector and cPanel PHP-FPM setups, and on phpMyAdmin. Hardly any sites use this feature, and turning it off closes one known route to CVE-2026-109619. On our web hosting platform, we now reject malformed upload requests that PHP could misread.
Once PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, we rolled them out across the platform and emailed customers to let them know.
We have not seen any increase in malware infections or unusual activity on our managed hosting since the vulnerabilities became public.
We continue monitoring traffic closely and will adjust our rules if attackers change tactics.
What you need to do
Every Hostinger hosting plan except VPS: nothing. We manage PHP for you, and the fix has been installed automatically. You can check the status here.
If you run PHP yourself on VPS:
On a VPS server that is running PHP, you manage PHP yourself, so our server-level protections don’t apply. Act now:
- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 as soon as you can. It’s the only complete fix.
- Can’t update straight away? Set
session.upload_progress.enabled = Offinphp.inior your PHP-FPM pool config, then restart all PHP workers. Setting it in your code withini_setwon’t work. This only blocks one of the two bugs, so treat it as a stopgap. - Turn off uploads you don’t need and keep upload size limits reasonable. It lowers your risk, but it isn’t a substitute for updating.
A few things that apply to everyone:
PHP 8.1 and older versions no longer get fixes from the PHP project, but sites on them are still covered on our managed hosting. The same protections we have apply to every PHP version. Agency hosting already runs patched builds of every version it offers, and patched builds are now deployed for every version from 5.2 to 8.5 on Web, Cloud, and cPanel hosting.
Still, now is a good time to upgrade. Older versions miss many other security fixes, and PHP 8.2 stops getting security fixes on 31 Dec 2026. To upgrade your PHP version, go to the Hostinger dashboard → Websites → Dashboard → PHP Configuration and pick 8.3 or newer. Check that your theme and plugins support the new version first; if something breaks, you can switch back within the same login session.
Why you still need the PHP update
Firewall rules are a safety net. They stop the attacks we already know about, but attackers keep tweaking their requests to slip past them. The PHP update fixes the actual bug, so we treat the two as a pair: the update for the fix, the rules for extra cover.
Questions about your site? Our Customer Success team is available 24/7 via live chat in the Hostinger dashboard.
Gediminas is a communications specialist passionate about technologies and their possibilities. His main responsibility is to help people understand Hostinger products and their features. He likes spending his free time bathing in the hot tub, grilling, playing poker, fishing, and other activities.
Saulius is Chief Product Officer at Hostinger, where he builds and scales the company’s core online presence products for more than 5 million customers. His work focuses on building practical products that solve real customer problems. Saulius pays close attention to how people use technology in their everyday lives and looks for ways to make online work simpler, faster, and less time-consuming, so users can focus on what matters most to them.
