On 21 October, a serious security flaw in PHP came out. It's called php2shell (CVE-2026-109618 and CVE-2026-109619). PHP runs most websites, WordPress included. So you probably have questions. Am I affected? Is my server patched? Do I need to do anything?
The short answer: yes, every web hosting server is patched. For most websites, there's nothing left to do. Here are the details.
Am I affected?
Only websites that run on PHP on our web hosting were at risk. That's most websites, because WordPress, Joomla and most other systems use PHP.
Your email kept working the whole time. IMAP, POP3, SMTP and SiteBirdy were never switched off. Do you only have domain names and email, without web hosting? Then there's nothing for you to check.
Is my server patched?
Yes. We installed the fix on all our web hosting servers within a day:
- 21 October, in the evening: our LiteSpeed servers. That's da016 up to da045, except da033 and da038.
- The night of 21 to 22 October: our CloudLinux servers da004 up to da015, da033, da038, da046 and da047. They came last, because CloudLinux released its fix later.
All PHP versions from 5.6 up to 8.5 are patched.
Not sure which server your website is on? Log in to DirectAdmin. The address bar of your browser shows the server name, for example da021.site.eu.
Good to know: on our CloudLinux servers, PHP can still show the same version number as before, like 8.5.11. That's fine. CloudLinux added the fix to the version you already had.
Do I need to do anything?
Probably not. But check these three things:
- Did you take your website offline? On 21 October, we advised taking websites with sensitive data offline until the fix was in. You can safely put yours back online now.
- Does your website use PHP 5.5 or older? Those versions didn't get a fix. Switch to a newer version as soon as you can. In DirectAdmin, search for "PHP" and open Select PHP Version. PHP 8.2 or higher is best. An old website doesn't always work on a new version, so check it right after the switch.
- Does something look strange on your website? Pages you didn't make, new admin users or files you don't know? Read what to do when your WordPress website is hacked and contact us.
Webmail and phpMyAdmin are back
To be safe, we switched off two tools for a few hours on 21 October: Roundcube webmail at mail.site.eu and phpMyAdmin on the web hosting servers. Both were back that same evening. You can log in to webmail just like before.
Since then, we've also gone through all our servers and made their security even tighter.
Questions?
Just contact our support team. We're happy to check your website and server with you.
