October 21, 2026
A pair of critical PHP security vulnerabilities known collectively as PHP2Shell were disclosed today. Because PHP powers WordPress and a huge portion of the web, this isn’t a vulnerability we were going to sit around and wait on.
We learned about the issue this morning and immediately contacted our hosting partner, InMotion Hosting, to find out where things stood with the dedicated servers we use to host and manage client websites.
The good news for Cider House clients is that InMotion was already on it.
InMotion prioritized its dedicated-server infrastructure as it began responding to PHP2Shell. Both of the dedicated servers we manage for our clients received InMotion’s security remediation this morning.
We didn’t stop there.
Later in the day, we checked the PHP versions installed on our servers through WHM and noticed that the version numbers didn’t appear to correspond with the new PHP releases announced today.
So we went back to InMotion.
Their support team checked both of our servers individually and confirmed that the security updates had been applied. Some of this work is being handled through backported and server-level updates, which means the version number displayed in a control panel doesn’t necessarily tell the whole story.
We also run Imunify360 across both servers. Its web application firewall has received new rules designed to block the currently known PHP2Shell exploit while permanent PHP updates continue to roll out.
PHP2Shell is the name being used for two newly disclosed vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619.
Both have been rated Critical, with a CVSS score of 9.2.
The concern is remote code execution. In plain English, a successful attack against a vulnerable server could allow someone who isn’t logged in to execute code on that server.
This is not specifically a WordPress vulnerability. The vulnerabilities are in PHP itself, the programming language WordPress runs on. That means the issue reaches far beyond WordPress and can affect websites and applications built on a number of platforms.
The PHP development team released security updates today for PHP 8.2, 8.3, 8.4 and 8.5 and is urging users to update immediately.
This is one of the areas we’re continuing to watch.
Most websites should be running a currently supported version of PHP, but there are legitimate situations where an older website can’t simply be moved to a newer PHP version without something breaking.
We manage a small number of legacy websites in exactly that situation.
We’re not going to make a rushed PHP upgrade on a production website if we already know that upgrade creates compatibility problems. Instead, we’re monitoring the security updates and backported fixes being made available for those older environments while keeping additional protections on our servers in place.
This is also why checking a PHP version number alone isn’t necessarily enough to determine whether a hosting environment has been protected. If you’re concerned about a website hosted somewhere else, ask your hosting provider specifically how it is addressing PHP2Shell.
There is nothing you need to do right now.
Our dedicated servers received InMotion’s PHP2Shell remediation this morning. Imunify360 is providing an additional layer of protection across both servers, and we’re continuing to monitor PHP, cPanel, CloudLinux and InMotion as additional updates become available.
We’ll apply further updates as they’re released and will update this page if there’s anything our clients need to know or do.
This is also a good example of what website maintenance and managed hosting often look like from our side of the screen.
Most of the time, our clients never see this work. A vulnerability is announced. We find out about it. We check the servers, talk to our hosting partner, verify what’s been done, investigate anything that doesn’t look right and keep watching until the issue is resolved.
That’s part of what we’re here for.
Inmotion Hosting was on top of this issue, with pnly a few hours warning. We think they are the best. We wrote about it here.
This situation is still developing. For those who want to dig deeper, we’ve included links below to the official PHP security information, InMotion Hosting’s live infrastructure update and CloudLinux’s information about its Imunify360 protections.
We’ll continue updating this post as the rollout progresses.
PHP — Critical Remote Code Execution Security Advisory
Official information from the PHP development team, including the newly released PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 security updates.
InMotion Hosting — Security Maintenance: PHP Configuration Updates
InMotion’s live status report covering its response to PHP2Shell and deployment across its hosting infrastructure.
CloudLinux — PHP CVE-2026-109618 and CVE-2026-109619: Imunify360 Ruleset 8.83
Technical information about the additional WAF protection being deployed through Imunify360 while PHP updates continue to roll out.
What 19 Years With One Company Taught Me About Customer Service, Company Culture, and Brand…
SEO for Plumbers: The Plumber SEO Guide to Rank Higher and Get More Calls You…
At about 8:00 Thursday morning, the first client text came in. Their website was down.…
A Practical Guide to Budgeting for SEO, Google Ads, Websites & Lead Generation Estimated reading…
Building a Digital Home for a Working Railroad in Northern Arizona At Cider House, we’ve…
If you run a small business in Western Massachusetts, your WordPress site is not just…