On October 21, 2026, the PHP team patched two security vulnerabilities. PHP is the technology on which WordPress and the majority of all websites run. Through these vulnerabilities—now known as “php2shell”—attackers could execute arbitrary code on a web server without a password. What’s notable is that details about them had already been leaked to the public a day before the official update.
Background on the Security Vulnerabilities
Every request sent to a website—such as a completed contact form or an uploaded image—is first processed by the underlying PHP software before WordPress or the actual website even sees it. It was precisely in this first processing step that the two vulnerabilities were found. An attacker simply had to send a specially crafted form to a website. In the case of the first vulnerability, CVE-2026-109618, this caused PHP to run out of memory before the data had been fully read, and PHP subsequently treated the incomplete data as valid. In the second vulnerability, CVE-2026-109619, remnants of a previous request remained in memory and were inadvertently reused during the next request. In both cases, this allowed the attacker to execute their own commands on the server without a password and without the website itself noticing. In the worst-case scenario, the attacker could have used this to read data, modify content, or exploit the server for further attacks. Virtually every website that uses PHP was affected, whether it was a WordPress site, a SaaS application, an online store, or a club website.
Security vulnerabilities are nothing out of the ordinary—so why was it different this time?
The Australian security expert Mathew Clark wrote on his blog, „Secure in Seconds“ described what makes this case so unusual. In the past, weeks would often pass between the release of an update and the first waves of attacks. This time, experts expected massive attacks to begin only about 15 minutes Start after the update. So if you wait until the update is released to take action, it will already be too late. The key is to be prepared in advance.
Clark also emphasizes: The gap lies not in WordPress or a plugin, but one level below that, on the server. Updating the plugin won't help, therefore. Only the person who manages the server can fix the problem. His most important question for every company is therefore: Who is actually in charge of server maintenance here? Anyone who can't answer that in a minute is at real risk.
Websites running older versions of PHP are particularly at risk, as there are no longer any official updates available for them.
Here's how our day went
For our RundUmsorgt Customers The question of who was responsible was quickly answered: it was us. That very morning, we implemented protective measures on our servers that blocked the known attack vector. Every single website was then checked. The official patch was released at 4:00 p.m., and about an hour and a half later, it was up and running on all of our servers.
The situation is different for shared hosting providers that do not offer support. Since we don't have access to the technical infrastructure there to install security patches, website operators have to wait until the respective provider takes action.
At one of the major providers—which hosts some customer websites that aren’t with us—the patch was still pending that evening (October 21, 26, at 9:00 p.m.). Wherever we had access, we implemented the most important protective measures there as well: We minimized the attack vector by making adjustments to the .htaccess file (which is essentially a text file where you can specify additional server configurations on a per-folder basis). However, in such cases, we cannot install the core protection—the actual update—ourselves.
As of October 22, 2026
Our servers (IP Projects, RundUmsorgt customers):
Yesterday, we promptly applied the patches to our servers to secure PHP against the newly discovered vulnerabilities. Your websites are now protected, and we have lifted the restrictions on forms and file uploads.
Websites without a maintenance contract that are not hosted by us (Hostinger, Ionos, Strato, Alfahosting):
Websites on Hostinger:
Hostinger has set up an internal protection system similar to ours and is now rolling out the updates throughout the day.
We have also implemented our own security measures on Hostinger websites to which we have access. As a result, file uploads and some forms are currently not working on those sites. We will lift this restriction as soon as Hostinger has applied the update.
Hostinger has since applied the patches. However, Hostinger did not update the PHP version; instead, it applied the patches to the old version. So don’t be surprised if the old version number is still listed there. What matters is the update date listed under `phpinfo()`; it must show at least October 21, 2026.
Websites on Ionos:
Ionos has rolled out updates to its servers. This may have caused some accessibility issues (slow-loading pages).
Ionos https://www.ionos-status.de/
Websites on Strato:
We were unable to find any official status updates for Strato.
If your website is hosted by Strato and you need an audit, please feel free to contact us.
Update: The message from Strato appears when you log in to the Strato console: The patches have been applied; your website should now be secure. But: Now would be a good time to check whether you might be paying far too much for hosting through what’s known as “PHP Extended Support.” Please contact us if this item—amounting to approximately €15 per month—appears on your invoice. In many cases, you don’t need it.
Websites at Alfahosting:
Alfahosting has rolled out the updates; your website should be secure.
https://status.alfahosting.de/issues/6ad8bf5c6e278df96274bad0
We'd be happy to review your hosting and website on a case-by-case basis. If you notice anything unusual about your website, Please contact us right away.