On October 21, 2026, two crucial PHP vulnerabilities, jointly referred to as PHP2Shell, had been publicly disclosed. Those vulnerabilities may just permit attackers to execute malicious code on affected servers with out authentication. The PHP construction group launched emergency safety updates the similar day to handle them.
In case your WordPress web page is hosted on Kinsta, it’s secure in opposition to PHP2Shell. Our engineering and safety groups deployed the vital PHP safety updates throughout our web hosting platform, together with reside and staging environments. We discovered no proof of breaches comparable to those vulnerabilities.
Right here’s what you will have to find out about PHP2Shell, how we treated the vulnerabilities, and the way to test your web page’s PHP settings.
What’s PHP2Shell?
PHP2Shell refers to 2 PHP vulnerabilities, recognized as CVE-2026-109618 and CVE-2026-109619. Each won a crucial severity ranking of 9.2 beneath CVSS 4.0.
The vulnerabilities have an effect on how PHP handles reminiscence when processing requests. If exploited, an attacker may just run malicious code on a server, doubtlessly compromising the internet sites and information hosted there.
Since WordPress runs on PHP, those vulnerabilities additionally offered a possibility to WordPress internet sites the usage of affected PHP variations.
In contrast to vulnerabilities present in a WordPress plugin, theme, or WordPress core, PHP2Shell impacts the PHP runtime itself. This implies updating WordPress or its plugins wouldn’t get to the bottom of the problem. The server’s PHP device had to be patched.
The PHP group launched fixes for PHP 8.2, 8.3, 8.4, and eight.5 on October 21. Older PHP variations won safety fixes from third-party maintainers.
For Kinsta consumers, we treated those updates on the web hosting point reasonably than requiring adjustments to particular person WordPress installations.
How Kinsta answered to PHP2Shell
Our engineering and safety groups started making ready for PHP2Shell earlier than the legitimate safety patches turned into to be had. The reaction concerned including protections to scale back the chance of exploitation, then deploying patched PHP variations as they had been launched.
Blocking off exploit makes an attempt with Cloudflare
Considered one of our first priorities used to be protective internet sites whilst we ready the PHP fixes. Kinsta makes use of Cloudflare’s Internet Software Firewall (WAF) to lend a hand determine and block malicious requests earlier than they achieve internet sites hosted on our platform.
Ahead of the PHP2Shell disclosure, Cloudflare deployed new firewall protections designed to locate makes an attempt to milk those vulnerabilities. Our group enabled the related protections throughout our web hosting infrastructure.
Consequently, our edge-level firewalls had been already blockading PHP2Shell exploitation makes an attempt whilst we waited for the PHP patches and all the way through their deployment.
We additionally carried out further PHP configuration adjustments throughout our web hosting environments to scale back doable publicity. Right through the incident, we stayed in shut touch with our Vulnerability Coverage spouse, Patchstack, sharing details about the threats and assault patterns we noticed.
Those measures helped give protection to internet sites whilst we ready updates, however they weren’t a substitute for patching PHP itself.
Making use of the PHP safety updates
As soon as the PHP group launched the fixes, our engineering group started validating and deploying the patched PHP applications around the platform.
We deployed safety updates for PHP 7.4 thru PHP 8.5, together with patches for older variations equipped through Freexian, our PHP bundle supplier.
As a result of we arrange PHP on the platform point, consumers didn’t want to set up the fixes or manually alternate their PHP variations. Our group treated the updates around the web hosting infrastructure whilst preserving the extra Cloudflare protections in position.
On October 22, 2026, at 08:26 UTC, we marked the incident resolved on our public standing web page, confirming that every one websites had been secure and the protection updates have been rolled out around the platform.
Right through the incident, our group monitored suspicious process, manually checked websites that seemed to be focused, and persevered spot-checking web hosting environments for indicators of compromise. We discovered no proof of a success breaches associated with PHP2Shell.
You’ll learn the updates revealed right through the reaction on our PHP safety incident standing web page.
Do Kinsta consumers want to take any motion?
No. In case your WordPress web page is hosted on Kinsta, we’ve already carried out the vital safety updates.
You don’t want to alternate your PHP model, set up a separate patch, or take your web page offline as a result of PHP2Shell. The protections additionally quilt your staging environments.
In case you suspended any environments as a precaution whilst we addressed the vulnerabilities, you’ll reactivate them now. Our group additionally carried out the related safety updates on suspended environments.
You will have to nonetheless stay your WordPress set up, plugins, and topics up to date as a part of your commonplace web page repairs. Alternatively, the ones updates are become independent from the PHP2Shell fixes, which we’ve already carried out on the web hosting point.
The place to seek out updates and get lend a hand
In case you arrange WordPress internet sites for purchasers, you’ll percentage our legitimate PHP safety incident document with them. It paperwork the updates we made as patched PHP variations turned into to be had and confirms the incident’s answer.
In case you have questions on a selected web page or need to ascertain its safety standing, you’ll touch our toughen group without delay thru MyKinsta. Our group is to be had 24/7 to lend a hand.
For more info, see our information to contacting Kinsta Toughen.
The publish PHP2Shell: How Kinsta secure WordPress websites seemed first on Kinsta®.
WP Hosting