Book a demo
Book a demo
Login
SecurityFixed

v2.9.4

Security Release – πŸ”’ PHP2Shell (CVE-2026-109618 & CVE-2026-109619) Patched Across xCloud

PHP2Shell is a pair of critical remote code execution vulnerabilities in PHP itself, rated CVSS v4.0 9.2. We applied a temporary mitigation across connected xCloud servers before the official fix was released. Then we rolled out the patched PHP builds, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, on both NGINX and OpenLiteSpeed servers. On a supported PHP version, nothing needs to be done from your end. Read the full PHP2Shell update.

πŸ›‘οΈ Mitigation Before the Official Fix

  • Applied before PHP’s release. On the morning of 21 October, hours before PHP’s 14:00 UTC release, a temporary mitigation was applied automatically to PHP on every connected Managed and Self-Managed server, including Docker servers that run PHP on the host. It was a stopgap, not a complete fix.
  • One email per team. Each team received an email listing its protected servers and how many sites are on each, plus any servers we could not reach.
  • Unreachable servers retried daily. Servers that were offline during the rollout are retried every day at 19:00 UTC, so they are covered once they reconnect.
  • Large OpenLiteSpeed servers covered. The mitigation now applies on OpenLiteSpeed servers with more than 100 sites, and on servers with leftover files from a removed PHP version.

βœ… Official PHP Patch Rolled Out

  • Patched PHP on NGINX and OpenLiteSpeed. The fixed builds, 8.5.12, 8.4.27, 8.3.36 and 8.2.35, were installed on connected servers for every supported PHP version.
  • Safe by design. The rollout only upgrades PHP packages that are already installed. It stops before any change if it would remove a package, downgrade one or add a new PHP version.
  • Verified, not assumed. After each update, PHP is restarted and checked so the fixed version is the one actually serving your sites. A few sites on each server are checked before and after to make sure they still load.
  • New PHP package source for NGINX servers. After the release, the Launchpad PPA that serves PHP for Ubuntu was overloaded and refused most requests. NGINX servers now get PHP from packages.sury.org, OndΕ™ej Surý’s own repository, which had the fixed builds. OpenLiteSpeed servers keep LiteSpeed’s repository.
  • The xCloud platform is patched too. The xCloud dashboard and API run on PHP 8.4.27.

✨ Improvements

  • See the exact PHP release. Manage PHP now shows the full installed release, such as PHP 8.3.36, instead of only PHP 8.3. It updates right after a patch installs. Install PHP security patches.
  • Notice for old PHP versions. Teams with sites on PHP below 8.2, or old PHP versions still installed, get an email listing them, because those versions get no official fix.

🐞 Fixed

  • PHP restarts after every patch. Updating PHP from Manage PHP now restarts PHP-FPM for every version on NGINX servers. On OpenLiteSpeed it also stops old lsphp workers, so sites no longer keep running the previous PHP build after an update.
  • Scan Patch checks every installed PHP version. Scan Patch in Manage PHP skipped the PHP version installed when the server was created (usually PHP 8.3) and versions whose earlier install showed as failed, so their patch was never offered. It now checks every installed version and offers Update to for them too. The PHP patch-info endpoint of the Public API got the same fix.

Please note

  • Double-check in one click. Open Server β†’ Management β†’ Manage PHP and click Scan Patch. If a version still shows a patch, for example on a server that was offline, click Update to. If nothing shows, check the installed version: 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer is patched. Install PHP security patches.
  • PHP 8.1 or older: these versions are end of life and get no official fix. Move those sites to PHP 8.3 or newer after testing on staging, then uninstall the versions no site uses. How to upgrade your PHP version.
  • Ubuntu 20.04: the PHP package repositories no longer build for it, so PHP 8.2 or newer cannot be installed, and a version installed earlier, such as PHP 8.3, gets no patch. Create a new Ubuntu 24.04 or 26.04 server and move everything onto it with full server clone. PHP versions compatibility.
  • Your own Docker containers: we only update PHP installed on the server. Rebuild your images with the fixed PHP version.
  • Future patches: turn on Security β†’ Security Update β†’ Include PHP, database and Redis updates to install PHP patches automatically. How automated security updates work.
  • Running WordPress elsewhere too? Our PHP2Shell checklist for WordPress on any host covers patching, stopgaps and compromise checks.