Critical PHP Vulnerabilities (PHP2Shell / CVE-2026-109618 & CVE-2026-109619)

Update timeline

1. identified Oct 21, 2026, 01:55 AM UTC

   We would like to inform you about two critical security vulnerabilities in the PHP scripting language. Please read this post carefully and in full. We ask for your understanding that information is still limited, the situation may change at any time, and this post will therefore be updated continuously. Please subscribe to our status page to receive updates and check this post regularly. Summary According to current assessments, these vulnerabilities allow remote code execution in all PHP versions from version 5 onwards. In simple terms, attackers can exploit them to execute arbitrary code in the context of the affected PHP application. The application only needs to be accessible over the internet. With nearly 70% of all websites using PHP, the potential impact is substantial. Of particular concern is that only PHP 8.5, 8.4, 8.3 and 8.2 still receive security updates. Websites running older PHP versions that are no longer supported should therefore be migrated to a current version immediately. We do not want to cause panic: our specialists convened immediately, developed an action plan and have already begun implementing it. All departments are ready to respond. Nevertheless, website operators and server administrators need to remain alert and act quickly. Further information on our response and our recommendations is provided below. Details of the vulnerabilities were originally scheduled to be published on 22.10.2026 at 17:00 CEST, after the corresponding security updates had been made available. However, information was leaked by unknown parties a few hours ago. The PHP security team has therefore announced that the release has been brought forward and is imminent. Managed servers and web hosting We have begun disabling outdated PHP handlers. This means that only PHP versions that still receive security updates can be selected. We strongly urge you to switch your websites to one of these versions immediately. Where necessary, isolate outdated applications that cannot be migrated immediately from the internet, then migrate them to newer software without leaving them exposed. Please note: As soon as we become aware of a publicly available and therefore actively exploited exploit, we will immediately disable unsupported PHP versions across all managed servers and web hosting servers by switching the affected websites to PHP 8.5. You would then be able to switch back as far as PHP 8.2, but would no longer be able to select an unsupported version. We understand that this would be a drastic step, but we must consider it to protect your data and that of your customers. For supported PHP versions, we expect updates over the coming days and will install them as soon as they become available. At present, we cannot predict whether exploits will become public and be used before then. Please assess whether you wish to isolate your PHP-powered websites from the internet until updates are available. Unmanaged (self-managed) servers Our recommendation: migrate outdated PHP applications to a supported PHP version immediately. Update your PHP installation as soon as updates become available for your system. If your operating system no longer receives updates, upgrade it immediately. Isolate applications from the internet if they cannot be migrated promptly. Outlook Once sufficient technical details are available, we will also assess whether the attack vectors can be mitigated at the web server level (for example, through a Web Application Firewall enabled by default on Plesk servers) or by other means. Until we know more, however, we must assume that running a supported PHP version and installing the corresponding updates is the only option. dataforest's own infrastructure For our own infrastructure, we have decided to shut down particularly critical systems as a precaution until the situation becomes clearer – especially those that handle customer data or have extensive internal permissions. This may temporarily limit certain product and server management functions. During this time, you can ask our support team at [email protected] to carry out the corresponding actions for you at any time. Sources https://www.php.net/archive/2026.php https://cert.europa.eu/publications/security-advisories/2026-018/ https://watchtowr.com/intelligence/php-cve-2026-109618-faq/

2. identified Oct 21, 2026, 01:32 PM UTC

   - Updated: Title and sources - Specified: dataforest's own infrastructure - Please refrain from individual requests to our support about the situation. You find our suggested actions in this post. Migrate your websites to new (supported) PHP versions as described below or simply shut them down until PHP updates are released as a precautionary measure.

3. identified Oct 21, 2026, 01:59 PM UTC

   First exploitations are seen in the wild. We have shut down all PHP services on managed servers and web hosting servers. We understand that this is a drastic measure. It is necessary to protect your data. We are deploying PHP updates for supported versions across our infrastructure which were released a few minutes ago. Before bringing back online the systems, we will disable unsupported PHP versions by switching the affected websites to PHP 8.5. You will then be able to switch back as far as PHP 8.2, but you will no longer be able to select an unsupported version. If you are running PHP applications on an unmanaged server, shut them down now until you have updated. Emergency support is available via [email protected].

4. identified Oct 21, 2026, 04:22 PM UTC

   • All managed server and web hosting systems have been patched and updated. The rollout took some time due to overloaded download mirrors. • Our own infrastructure, including our customer portals, is back online. • Plesk panels are available again, too. • We have decided to take a different approach depending on the product: • Managed Servers: Websites configured to use unsupported PHP versions will not be automatically switched to PHP 8.5 to avoid compatibility issues. Instead, unsupported PHP versions will remain disabled, and affected websites will display an error page with HTTP status code 503 (Service Unavailable). Customers must manually select a supported PHP version in Plesk. • Webhosting: Websites configured to use unsupported PHP versions have been switched to PHP 8.5. Supported PHP versions down to 8.2 remain available for selection. • We have already started bringing our web hosting and managed servers back online. All websites running PHP 8.2 or later should be available again within the next 15-60 minutes. • The PHP team has provided minimal security backports for the end-of-life (EOL) versions PHP 7.4, 8.0 and 8.1 as a one-time exception. We are monitoring the situation closely, but please do not rely on these becoming available for our systems, especially since these are not yet available through Plesk or the relevant Linux distributions. Furthermore, these PHP versions had already reached end of life before and should no longer have been in use. For websites still configured to use an unsupported PHP version, switching to a supported version is currently the only available way to restore service on our systems.

5. identified Oct 21, 2026, 04:37 PM UTC

   We have temporarily disabled some payment methods in the Avoro customer area because external licensing and payment services are unavailable for the same reasons. These outages are beyond our control. We will reactivate the affected payment methods as soon as the external services are restored.

6. identified Oct 21, 2026, 06:13 PM UTC

   • All web hosting and managed servers were brought back online between 18:15 and 18:30 CEST. • Managed Servers: As previously explained, we have not changed any PHP versions on managed servers. If your website still uses an unsupported PHP version, please select a supported version in Plesk. Our support team can also switch all domains on your server that still use outdated PHP versions to PHP 8.2, 8.3, 8.4 or 8.5. Websites already using a supported PHP version should be accessible again. If this is not the case, or if you are experiencing other unexpected issues, please contact our support team. • Webhosting: If your application is compatible with PHP 8.2 or later but you are still experiencing issues, please contact our support team. • For all other cases related to this incident, including questions already answered in this post, please refrain from contacting our support team. This helps prevent support overload and keeps our team available for customers who need individual assistance. • Updates for managed mailcow instances became available a few minutes ago, and we are already deploying them. Brief service interruptions may occur during the rollout.

7. identified Oct 21, 2026, 08:34 PM UTC

   • We have temporarily disabled access to the Plesk control panels again. Further verification showed that the separate PHP runtime used by Plesk itself still requires an additional vendor security update. • This restriction affects Plesk access only. The websites restored earlier remain online. • We understand that you need panel access to manage your services, particularly to make the PHP version changes described in our earlier updates. We are sorry for the additional disruption. We currently have no ETA for restoring access. The panels will remain unavailable until we can apply and verify the required security update. • Managed Servers: You do not need panel access for this. Our support team ([email protected]) can still switch all domains on your server that use outdated PHP versions to PHP 8.2, 8.3, 8.4 or 8.5.

8. identified Oct 21, 2026, 11:14 PM UTC

   • Over the past few hours, we have verified and deployed exceptional security backports for PHP 7.4, 8.0 and 8.1 on our managed servers. These backports were made available separately, after the regular security updates for supported PHP versions, as a one-time exception for these end-of-life versions. Websites using these versions have been reactivated. • Following extensive internal discussion, we have made this temporary exception solely (for managed servers) because customers currently cannot access Plesk to change their PHP version themselves. Access to the Plesk control panels remains disabled. • Our instruction remains unchanged: switch to a supported PHP version immediately, update outdated software, and replace it where necessary. PHP 8.5 should be your migration target. Please notice: Active bugfix support for PHP 8.2 ended on 31.12.2024, it receives security updates only and will reach its official end of life on 31.12.2026. • Given the current threat landscape, including AI-assisted vulnerability research, we expect further serious security vulnerabilities to be discovered in outdated software. These exceptional backports do not restore ongoing security support for the affected versions! • If another security vulnerability affecting these outdated PHP versions becomes public, we will disable them again immediately and permanently. This also applies if the current security fixes are found to be incomplete. The temporary availability of these versions could therefore end at very short notice. • Regardless of further developments, we will permanently disable all PHP versions up to and including 8.2 on our systems in early 2027.. Please begin your migration to supported PHP versions now. This temporary exception serves only to facilitate the necessary migrations and minimise downtime.

9. identified Oct 22, 2026, 12:05 AM UTC

   • The security update for the Plesk control panel became available an hour ago. We immediately verified and deployed it. Access to the Plesk control panels has been restored. • Some non-critical or legacy customer portals may remain restricted. Our priority remains restoring availability of customer websites. We are paying particular attention to individual issues following the updates. If anything is not working as expected, please report it immediately to [email protected].