PHP vulnerability (CVE-2026-109618 / 109619): protective measures in place

Update timeline

1. monitoring Oct 21, 2026, 10:22 AM UTC

   Status Update (12:00 PM) Protective measures against the PHP vulnerability (CVE-2026-109618 / 109619) have been implemented across our entire infrastructure. No exploitation of our services has been observed; while attempts were made, they were detected and blocked by our security measures. No customer data has been affected by this vulnerability. The following remain temporarily restricted: * As a precautionary measure, access to control panels has been temporarily disabled pending the application of the official PHP patch, scheduled for today around 4:00 PM. * File uploads via the client area and phpMyAdmin are disabled until the patch is applied. * The client area is currently under maintenance; a restoration process is underway following a technical incident unrelated to this vulnerability. Your services (game servers, VPS, websites) continue to operate normally. A further update will be provided once the patch has been applied..

2. monitoring Oct 21, 2026, 02:00 PM UTC

   PHP released fixes for the critical php2shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) today at 16:00 CEST. However, several security researchers report that this fix may be incomplete and that the flaw may still be exploitable on updated versions. As a precaution, the following services remain offline: * the game panel ([panel.yorkhost.fr](http://panel.yorkhost.fr)); * the client area ([clients.yorkhost.fr](http://clients.yorkhost.fr)); * PHP web hosting and phpMyAdmin. Your game servers and VPS are not affected and are running normally. Our team has applied all available patches along with several additional layers of protection. Our initial checks have found no sign of compromise. We will reopen these services as soon as PHP publishes a confirmed fix and we have verified it. For urgent requests, reach us on Discord or by email. Thank you for your patience and trust..

3. monitoring Oct 21, 2026, 07:17 PM UTC

   The client area and the phpMyAdmin interfaces for MySQL-GAME-01, MySQL-GAME-02, and MySQL-P-GAME-01 are accessible again..

4. monitoring Oct 21, 2026, 07:27 PM UTC

   The GAME panel is accessible again.

5. monitoring Oct 21, 2026, 08:20 PM UTC

   Access to cPanel (WEB-01) and the various sites has been restored..

6. monitoring Oct 21, 2026, 10:18 PM UTC

   The Virtualizor-01 interface has been restored..

7. resolved Oct 21, 2026, 10:20 PM UTC

   PHP security fixes (CVE-2026-109618 / CVE-2026-109619, “php2shell”) have been applied across all our services. The client area, panel, phpMyAdmin and web hosting are available again. Our checks found no sign of compromise. As a precaution, file uploads (attachments, web hosting uploads) remain temporarily disabled while we wait for final vendor updates. Thank you for your patience..

8. monitoring Oct 22, 2026, 01:10 PM UTC

   # Post-mortem: "PHP2Shell" PHP vulnerabilities (CVE-2026-109618 / CVE-2026-109619) **Period:** October 21, 2026, 12:30 PM to October 22, 2026, 12:20 AM (Paris time) **Status:** Resolved. **Services taken offline:** client area ([clients.yorkhost.fr](http://clients.yorkhost.fr)), GAME panel ([panel.yorkhost.fr](http://panel.yorkhost.fr)), cPanel web hosting (WEB-01), phpMyAdmin (MySQL-GAME-01, MySQL-GAME-02, MySQL-P-GAME-01), Virtualizor-01 **Not affected:** game servers and VPS, which ran normally throughout the incident. ## Origin of the incident Two critical vulnerabilities, nicknamed "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619), were discovered in PHP. They are located in the PHP engine itself, not in any application: a website is exposed even if its own code is perfectly secure. They allow an attacker to execute code remotely on a server, without any authentication. The situation was made worse by a leak: on October 20, details of these flaws were made public before PHP released its official fix. Attackers therefore had information to exploit them while no update was yet available, and large-scale exploitation was observed as early as the morning of October 21. ## Why we took services offline Our administration and hosting interfaces rely on PHP. Keeping them online before a fix was available carried major risks: * command execution on our servers by an unauthenticated attacker * access to customer data (accounts, invoices, contact details) and databases * takeover of the GAME panel, and therefore actions on your game servers * malicious code being planted on hosted websites * lateral movement to the rest of our infrastructure Exploitation attempts did target our services: they were detected and blocked by our security measures. Taking the exposed interfaces offline was an additional step, so as not to rely solely on these protections while no official fix was available. ## Why we did not reopen everything as soon as the fix was released PHP released its fixes on October 21 at around 4:00 PM. We deliberately waited before reopening: * several security researchers reported that the fix might be incomplete * we monitored developments through independent security sources and community feedback * some services depended on third-party vendor updates (CloudLinux PHP packages for WEB-01, a Softaculous update for Virtualizor) * in parallel, we added several layers of protection (WAF rules, upstream filtering) and tested their effectiveness before each reopening Services were brought back online progressively from 9:00 PM onwards, as each one was verified (exact times are available in the incident history). ## Measures in place and possible impact for you * **PHP fixes applied** across all our services * **Strengthened filtering rules** (Cloudflare and web application firewall on our servers) that block requests matching known attack patterns. Possible side effect: some legitimate requests may be blocked (for example, an upload form returning a 403 error). **If your website or application behaves unexpectedly, contact us**: we will adjust the rules on a case-by-case basis * **File uploads disabled** (attachments, web hosting uploads) while we wait for final vendor updates. If you have an urgent need, contact us on Discord or by email * **No sign of compromise** was found during our checks. Enhanced monitoring remains active Faced with a flaw of this severity, already being actively exploited, we chose a temporary interruption rather than a risk to your data and services. Thank you for your patience and trust..