Hostinger deploys protections against php2shell PHP vulnerabilities

On October 21, the PHP project fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now known as php2shell. Both are rated 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS). Details leaked before the planned release, and exploit code for one of them was already circulating before the fix was out. We blocked the exploit attempts already circulating, and we’re rolling out PHP’s update across our platform.

In short:

• Every Hostinger hosting plan except VPS: nothing to do. We manage PHP on these plans and have taken care of it: the circulating exploit did not work against our servers, our firewall rules are blocking requests that match the attack, and we’re installing PHP’s fix on every server.
• VPS: if you manage PHP on your own server, update it and restart it now. The steps are below.

What we know about the vulnerabilities

Both bugs come down to how PHP cleans up memory when a request goes wrong. In the worst case, an attacker could run their own code on a server, read data they shouldn’t see, or take a site down.

Vulnerability	What goes wrong
CVE-2026-109618	A request pushes PHP to its memory limit at exactly the wrong moment. PHP stops halfway, leaves some data half-built, and later treats it as if it were complete.
CVE-2026-109619	An error interrupts a request, and PHP holds onto memory that has already been freed. The next request handled by the same process can then reach that leftover memory.

Every PHP version before 8.5.12, 8.4.27, 8.3.36, and 8.2.35 is affected, going back at least to PHP 5.4. That covers WordPress, WooCommerce, Magento, and most other PHP sites.

Because the flaw is in PHP itself, updating WordPress, themes, or plugins won’t fix it. Only a patched PHP does.

What we’ve done

First, we blocked the attacks already doing the rounds. We added security rules that catch known exploit patterns and updated our firewall rule set, which reaches every server running ModSecurity automatically. The rules run in deny mode, so any matching request is rejected by the server immediately.

We also switched off session.upload_progress on our LiteSpeed, PHP Selector and cPanel PHP-FPM setups, and on phpMyAdmin. Hardly any sites use this feature, and turning it off closes one known route to CVE-2026-109619. On our web hosting platform, we now reject malformed upload requests that PHP could misread.

Once PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, we rolled them out across the platform and emailed customers to let them know.

We’re still watching traffic closely and will adjust our rules if attackers change tactics.

What you need to do

Every Hostinger hosting plan except VPS: nothing. We manage PHP for you, and the fix installs automatically. You can check the status here.

If you run PHP yourself on VPS:

On a VPS server that is running PHP, you manage PHP yourself, so our server-level protections don’t apply. Act now:

1. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 as soon as you can. It’s the only complete fix.
2. Can’t update straight away? Set session.upload_progress.enabled = Off in php.ini or your PHP-FPM pool config, then restart all PHP workers. Setting it in your code with ini_set won’t work. This only blocks one of the two bugs, so treat it as a stopgap.
3. Turn off uploads you don’t need and keep upload size limits reasonable. It lowers your risk, but it isn’t a substitute for updating.

A few things that apply to everyone:

PHP 8.1 and older versions no longer get fixes from the PHP project, but sites on them are still covered on our managed hosting. The same protections we have apply to every PHP version. Agency hosting already runs patched builds of every version it offers, and our PHP vendor has committed to patched builds for every version from 5.2 to 8.5 on Web, Cloud and cPanel hosting.

Still, now is a good time to upgrade. Older versions miss many other security fixes, and PHP 8.2 stops getting security fixes on 31 Dec 2026. To upgrade your PHP version, go to the Hostinger dashboard → Websites → Dashboard → PHP Configuration and pick 8.3 or newer. Check that your theme and plugins support the new version first; if something breaks, you can switch back within the same login session.

Why you still need the PHP update

Firewall rules are a safety net. They stop the attacks we already know about, but attackers keep tweaking their requests to slip past them. The PHP update fixes the actual bug, so we treat the two as a pair: the update for the fix, the rules for extra cover.

Questions about your site? Our Customer Success team is available 24/7 via live chat in the Hostinger dashboard.

The post Hostinger deploys protections against php2shell PHP vulnerabilities appeared first on Hostinger Blog.