On October 21, 2026, two critical security vulnerabilities affecting PHP, the programming language that powers WordPress and millions of other websites, were publicly disclosed.
These vulnerabilities, collectively known as PHP2Shell, have understandably generated considerable concern. We’ve already heard from several clients asking whether their websites are affected and what they need to do.
The good news for PageCrafter hosting clients is that we’ve been actively addressing this issue since the vulnerabilities were disclosed. Security patches began rolling out promptly on October 21, and most of our managed hosting infrastructure received the necessary protections that same day.
We’ve also been reviewing individual hosting environments and updating additional websites as needed.
For most clients, no action is required.
What Is the PHP2Shell Vulnerability?
PHP is the server-side programming language used by WordPress and many other website platforms. It processes website requests, communicates with databases, and generates the pages visitors see.
The newly disclosed vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are particularly serious because they can potentially allow attackers to execute unauthorized code on vulnerable servers without logging in.
Both vulnerabilities received a critical severity rating of 9.2 out of 10.
Unlike a typical WordPress security vulnerability, these issues exist in PHP itself. That means simply updating WordPress, plugins, or themes isn’t enough to address them.
The PHP software running on the hosting server must receive the appropriate security patches.
How PageCrafter Responded
At PageCrafter, security is an important part of how we manage our website hosting services.
When the PHP2Shell vulnerabilities became public, security updates were promptly deployed across our hosting infrastructure, with most of our managed environments receiving protection on October 21.
We also reviewed the PHP versions running on our servers and took additional steps where necessary.
This included:
- Verifying that appropriate PHP security patches had been released and deployed.
- Reviewing hosting environments for outdated PHP installations.
- Upgrading older websites to patched PHP versions where appropriate.
- Resolving compatibility issues on legacy websites that required additional attention.
- Confirming the patching procedures used across our managed hosting environments.
One important aspect of this vulnerability is that some older PHP versions can receive security fixes through a process called backporting. This allows the vulnerability to be corrected without forcing a website to immediately upgrade to a newer PHP version.
That’s especially valuable for older websites, where changing PHP versions can sometimes cause compatibility problems.
Do PageCrafter Clients Need to Do Anything?
For most websites hosted with PageCrafter, no action is necessary.
These PHP vulnerabilities are addressed at the hosting level, and the required server-side updates are being handled as part of our hosting security response.
You do not need to attempt to change your PHP version, reinstall WordPress, or manually update plugins specifically to address PHP2Shell.
In fact, we recommend against making major changes to your website’s PHP environment without checking compatibility first.
If a particular website requires additional work to accommodate a security update, we’ll address that situation individually.
Of course, keeping WordPress, plugins, and themes updated remains an important part of overall website security. Those updates protect against different vulnerabilities and are still recommended as part of regular website maintenance.
Why Proactive Website Hosting Matters
Security vulnerabilities like PHP2Shell are a reminder that keeping a website secure involves more than occasionally updating WordPress.
Websites depend on numerous technologies behind the scenes, including PHP, web servers, database software, and operating system components.
When serious vulnerabilities are discovered, these underlying systems may require attention even if nothing about the website itself appears to have changed.
At PageCrafter, we believe website owners should be able to focus on running their businesses rather than monitoring server-level security announcements.
That’s why our hosting approach emphasizes reliable infrastructure, timely security updates, and proactive attention to the technical systems that keep websites running.
Questions About Your Website?
If you’re a PageCrafter hosting client and have questions about PHP2Shell or your website’s security, please don’t hesitate to reach out.
We’re happy to help you understand how your website is protected.
And if you’re looking for dependable, professionally managed WordPress hosting, we’d be glad to discuss how PageCrafter can help.
Learn more about our website hosting services or contact PageCrafter.
