Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619): Mandatory PHP Upgrade for All QUAPE Customers

On 21 October 2026 the PHP project released emergency security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known together as “PHP2Shell”. Both are rated 9.2 (Critical) on CVSS v4.0 and can allow an attacker to run code on a web server without logging in. Public exploit code is already circulating and early attacks have been reported.

Because every PHP-powered website is exposed, including WordPress, WooCommerce, Laravel and custom PHP applications, QUAPE is applying the fix to all shared and managed hosting accounts as a mandatory upgrade. This article explains what the vulnerability is, what we are doing, what you need to do, and what to expect.

The short version

Every version of PHP serving web requests is affected. The only complete fix is to run a patched release: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older are end of life and will not be patched, so sites on those versions must move to a supported branch. QUAPE is upgrading all hosting servers and will move any site still on PHP 8.1 or older to PHP 8.2 at minimum. No action is needed from most customers, but please read the “What you need to do” section.

What are CVE-2026-109618 and CVE-2026-109619?

Both flaws sit in PHP itself, not in a plugin, theme or framework, so changing your application code does not protect you.

• CVE-2026-109618 (RCE via out-of-memory corruption): when PHP runs out of memory while it is still reading an incoming request, internal request data can be left only partly initialised. A specially crafted request, for example a large or malformed file upload, can abuse this to execute code.
• CVE-2026-109619 (RCE via stale global state): after certain fatal errors, PHP can keep internal state that points at memory which has already been freed. A later request can reach that memory and turn it into code execution.

The PHP security team states that the issues affect all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with the highest risk on mod_php, where a demonstrated exploit triggers before any application code runs. No username, password or existing foothold is required.

Which versions are affected and which are fixed?

PHP branch	Status	Fixed in
PHP 8.5	Affected	8.5.12
PHP 8.4	Affected	8.4.27
PHP 8.3	Affected	8.3.36
PHP 8.2	Affected	8.2.35
PHP 8.1 and older (8.0, 7.x, 5.x)	Affected, end of life	No official fix. Upgrade required.

Linux distributions such as Ubuntu, Debian and Red Hat ship their own PHP packages and backport the fix on their own schedule. If your server uses distribution packages, the version number will not change to the ones above. Check your vendor's security advisory to confirm the backport has been applied.

What QUAPE is doing

1. Patching every hosting server. All QUAPE shared, WordPress and managed hosting servers are being updated to the patched PHP releases. This is a platform update and is not optional.
2. Retiring PHP 8.1 and older. Any website still running PHP 8.1, 8.0 or 7.x will be switched to PHP 8.2 or newer, because there is no secure version of those branches to move to. We are contacting the affected account owners directly.
3. Edge protection. Sites behind our Cloudflare-fronted plans benefit from the WAF rules Cloudflare has deployed for the known exploit paths. This is a stopgap and does not replace the patch.
4. Our own systems. The QUAPE website, customer portal and internal tools are being updated under the same programme.

What you need to do

Shared, WordPress and managed hosting customers

Nothing is required for the PHP update itself. We apply it on the server. If your site is on PHP 8.1 or older, we will move it to PHP 8.2 or newer. Most modern WordPress, WooCommerce and Laravel sites run on PHP 8.2 and 8.3 without changes, but very old themes, plugins or custom code may need attention. Please:

• Check your site after the upgrade window and tell us straight away if anything looks wrong.
• Update WordPress core, themes and plugins to their latest versions, which removes most PHP 8 compatibility problems.
• Do not ask us to roll back to PHP 8.1 or older. We cannot offer an unpatched version on our platform.

VPS, dedicated server and colocation customers

You manage the operating system on these services, so you must patch PHP yourself as a matter of urgency:

1. Run your distribution's update (for example apt update && apt upgrade or dnf update) and confirm the PHP package includes the fix for CVE-2026-109618 and CVE-2026-109619.
2. If you compile PHP or use a third-party repository, install 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
3. Restart PHP-FPM, Apache, LiteSpeed or your container so that every worker picks up the new build.
4. If you cannot patch immediately, apply the interim measures below and restrict access to the site until you can.

If you would like QUAPE to patch a server for you, open a support ticket from your account and our engineers will schedule it.

Interim measures if you cannot patch today

The PHP project is clear that these settings reduce exposure but do not make an installation safe. Use them only to bridge the gap until the update is applied, and set them in php.ini, the FPM pool or the web server configuration, not with ini_set() or .user.ini:

• session.upload_progress.enabled = 0, then restart all PHP workers.
• On PHP 8.5, fatal_error_backtraces = 0, then restart all workers.
• Lower post_max_size (8M if the site does not accept uploads, 32M if it does) and keep upload_max_filesize below it.
• Enforce request size and part-count limits at the web server or reverse proxy.
• Fix any fatal errors or execution timeouts that an attacker can trigger. Hiding errors with display_errors or @ does not help.

Has QUAPE been affected?

We have no indication of compromise on our platform. We are monitoring our servers for the known exploit patterns and will update this article if that changes. If you notice unexpected files, admin users or outbound traffic on your site, contact support immediately so we can investigate.

Timeline

• 20 October 2026: PHP announces an emergency security release for the following day.
• 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 released. QUAPE begins platform-wide upgrades.
• Next steps: we will update this article as each server group is completed and when the PHP 8.1-and-older migration is finished.

Questions

If you are unsure which PHP version your site uses, log in to your QUAPE account, open the hosting control panel and check the PHP selector, or raise a ticket and we will tell you. For anything related to this update, reply to the notification email you received or open a support ticket from your account.

References: PHP project security advisory of 21 October 2026, GitHub advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.