Yesterday, October 21, 2026, security researchers publicly disclosed PHP2Shell, a series of critical PHP security vulnerabilities affecting websites around the world. PHP powers approximately 70% of websites, including popular platforms such as WordPress, Drupal, and Joomla.
Springs Hosting has completed patching all of our shared hosting servers and other servers we manage to address these vulnerabilities.
What is the PHP2Shell vulnerability?
PHP2Shell refers to multiple security vulnerabilities discovered in PHP, the programming language responsible for powering much of today’s web.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, include remote code execution (RCE) and memory disclosure risks. If successfully exploited, attackers could potentially execute malicious code, access sensitive information, or compromise affected servers.
What makes these vulnerabilities particularly concerning is that they exist within PHP itself. Even websites running fully updated versions of WordPress or other content management systems could be affected if the underlying PHP installation remained vulnerable.
Security researchers at Wiz discovered the vulnerabilities with assistance from artificial intelligence, and coordinated with the PHP development team and other industry partners ahead of the public disclosure.
How Springs Hosting responded
At Springs Hosting, protecting our customers’ websites and data is a priority. Following the release of PHP security patches on October 21, we completed the necessary updates across our shared hosting infrastructure and other servers under our management.
Our shared hosting servers use several layers of security, including CloudLinux, an operating system designed specifically for web hosting that isolates customer websites and provides security maintenance for older PHP versions. We also use cPanel for hosting management and Imunify360 for malware detection, intrusion prevention, and web application firewall protection.
Imunify360 released additional protection rules on October 21 to help mitigate exploitation attempts while hosting providers deployed the official PHP updates.
We also maintain daily website backups, providing an additional recovery option if a website is ever compromised or experiences another issue.
These protections work together to reduce security risks and help us respond quickly when new vulnerabilities are discovered.
How AI is changing cybersecurity
One of the most significant aspects of PHP2Shell is the role artificial intelligence played in its discovery.
According to Wiz researchers, the underlying weaknesses existed in PHP for more than a decade. AI-assisted security research helped identify and develop exploitation techniques for vulnerabilities that had previously gone undetected.
As AI technology continues to improve, we expect to see more vulnerabilities discovered in PHP and other widely used software.
These capabilities can benefit cybersecurity researchers and software developers, but they also reinforce the importance of timely patching, continuous monitoring, and maintaining multiple layers of security.
What Springs Hosting customers need to do
Customers using our shared hosting services do not need to take any action to install these server-level PHP patches. We’ve handled those updates as part of our managed hosting infrastructure.
We still recommend keeping WordPress, website plugins, themes, and other applications updated, using strong passwords, and enabling multifactor authentication wherever available.
For businesses operating their own servers or using unmanaged hosting services, we recommend confirming that their hosting provider or server administrator has applied the appropriate PHP security updates.
Learn more about PHP2Shell
For a detailed technical explanation of the vulnerabilities and their discovery, read the research published by Wiz:
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
Springs Hosting provides secure web hosting, cloud infrastructure, and managed hosting services from Colorado Springs, Colorado. We’ll continue monitoring emerging security threats and applying updates to help protect the websites and infrastructure our customers depend on.