On October 21, 2026, the PHP team patched two security vulnerabilities. PHP is the technology on which WordPress and the majority of all websites run. Through these vulnerabilities\u2014now known as \u201cphp2shell\u201d\u2014attackers could execute arbitrary code on a web server without a password. What\u2019s notable is that details about them had already been leaked to the public a day before the official update.<\/p>\n\n\n\n
Every request sent to a website\u2014such as a completed contact form or an uploaded image\u2014is first processed by the underlying PHP software before WordPress or the actual website even sees it. It was precisely in this first processing step that the two vulnerabilities were found. An attacker simply had to send a specially crafted form to a website. In the case of the first vulnerability, CVE-2026-109618<\/a>, this caused PHP to run out of memory before the data had been fully read, and PHP subsequently treated the incomplete data as valid. In the second vulnerability, CVE-2026-109619<\/a>, remnants of a previous request remained in memory and were inadvertently reused during the next request. In both cases, this allowed the attacker to execute their own commands on the server without a password and without the website itself noticing. In the worst-case scenario, the attacker could have used this to read data, modify content, or exploit the server for further attacks. Virtually every website that uses PHP was affected, whether it was a WordPress site, a SaaS application, an online store, or a club website.<\/p>\n\n\n\n The Australian security expert Mathew Clark wrote on his blog, \u201eSecure in Seconds\u201c<\/a> described what makes this case so unusual. In the past, weeks would often pass between the release of an update and the first waves of attacks. This time, experts expected massive attacks to begin only about 15 minutes<\/strong> Start after the update. So if you wait until the update is released to take action, it will already be too late. The key is to be prepared in advance.<\/p>\n\n\n\n Clark also emphasizes: The gap lies not in WordPress or a plugin, but one level below that, on the server<\/strong>. Updating the plugin won't help, therefore. Only the person who manages the server can fix the problem. His most important question for every company is therefore: Who is actually in charge of server maintenance here?<\/strong> Anyone who can't answer that in a minute is at real risk. <\/p>\n\n\n\n Websites running older versions of PHP are particularly at risk, as there are no longer any official updates available for them.<\/p>\n\n\n\n For our RundUmsorgt Customers <\/a>The question of who was responsible was quickly answered: it was us. That very morning, we implemented protective measures on our servers that blocked the known attack vector. Every single website was then checked. The official patch was released at 4:00 p.m., and about an hour and a half later, it was up and running on all of our servers.<\/p>\n\n\n\n The situation is different for shared hosting providers that do not offer support. Since we don't have access to the technical infrastructure there to install security patches, website operators have to wait until the respective provider takes action. <\/p>\n\n\n\n At one of the major providers\u2014which hosts some customer websites that aren\u2019t with us\u2014the patch was still pending that evening (October 21, 26, at 9:00 p.m.). Wherever we had access, we implemented the most important protective measures there as well: We minimized the attack vector by making adjustments to the .htaccess file (which is essentially a text file where you can specify additional server configurations on a per-folder basis). However, in such cases, we cannot install the core protection\u2014the actual update\u2014ourselves.<\/p>\n\n\n\n Yesterday, we promptly applied the patches to our servers to secure PHP against the newly discovered vulnerabilities. Your websites are now protected, and we have lifted the restrictions on forms and file uploads.<\/p>\n\n\n\n Websites on Hostinger:<\/strong><\/p>\n\n\n\n Hostinger has set up an internal protection system similar to ours and is now rolling out the updates throughout the day.<\/p>\n\n\n\n We have also implemented our own security measures on Hostinger websites to which we have access. As a result, file uploads and some forms are currently not working on those sites. We will lift this restriction as soon as Hostinger has applied the update.<\/p>\n\n\n\n Hostinger has since applied the patches. However, Hostinger did not update the PHP version; instead, it applied the patches to the old version. So don\u2019t be surprised if the old version number is still listed there. What matters is the update date listed under `phpinfo()`; it must show at least October 21, 2026.<\/p>\n\n\n\n Websites on Ionos:<\/strong><\/p>\n\n\n\n Ionos has rolled out updates to its servers. This may have caused some accessibility issues (slow-loading pages). Websites on Strato:<\/strong><\/p>\n\n\n\n We were unable to find any official status updates for Strato. Update: The message from Strato appears when you log in to the Strato console: The patches have been applied; your website should now be secure. But<\/strong>: Now would be a good time to check whether you might be paying far too much for hosting through what\u2019s known as \u201cPHP Extended Support.\u201d Please contact us if this item\u2014amounting to approximately \u20ac15 per month\u2014appears on your invoice. In many cases, you don\u2019t need it.<\/p>\n\n\n\n Websites at Alfahosting:<\/strong><\/p>\n\n\n\n Alfahosting has rolled out the updates; your website should be secure.Security vulnerabilities are nothing out of the ordinary\u2014so why was it different this time?<\/h2>\n\n\n\n
Here's how our day went<\/h2>\n\n\n\n
As of October 22, 2026<\/h2>\n\n\n\n
Our servers (IP Projects, RundUmsorgt customers):<\/h3>\n\n\n\n
Websites without a maintenance contract that are not hosted by us (Hostinger, Ionos, Strato, Alfahosting):<\/h3>\n\n\n\n
Ionos https:\/\/www.ionos-status.de\/<\/a><\/p>\n\n\n\n
If your website is hosted by Strato and you need an audit, please feel free to contact us.<\/p>\n\n\n\n
https:\/\/status.alfahosting.de\/issues\/6ad8bf5c6e278df96274bad0<\/a><\/p>\n\n\n\n