On this page
On October 21, 2026, the PHP project released fixes for two critical security issues, and websites around the world rushed to update. Your Vodlix platform was protected before the news broke, and there is nothing you need to do.
What happened?
Researchers found two issues in how PHP handles memory and errors, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed php2shell. Under the right conditions, an attacker could use them to run code on a web server without logging in. The PHP Foundation rated them critical and released fixes the same day they were made public.
The response across the internet was fast. Exploit attempts climbed into the millions within hours, and some government and commercial sites went offline as a precaution, as MediaNama reported.
How was your Vodlix platform protected?
Your platform was protected on three fronts before anything could happen.
Protection | What it does |
|---|---|
Vodlix Shield | Our own fast, lightweight tool, built specifically for PHP vulnerabilities and typical attack scenarios. It filters requests in front of our systems |
AI monitoring | Watches our traffic for attack patterns |
The patch | Applied before the issues were made public |
Our tech team patched the PHP in our middleware, the only part of Vodlix that uses PHP, ahead of the public release. Every Vodlix cloud, and so every customer platform, is up to date. You did not need to take any action.
Why were we ready?
Since the release of smarter AI models, we have watched a new wave of security issues emerge, as AI helps researchers and attackers find weaknesses faster. We began preparing for attacks like this early this year, which is why Vodlix Shield was already in place when these issues went public.
What comes next?
No protection is ever foolproof. What matters is how fast an issue is caught and contained, so we keep adding new techniques and improving our protection.
We are also building a self-healing system that uses AI, so our technology can detect an incident, recover and protect itself before it ever needs a person. Most of the internet runs on open-source technology, and no one can be certain which part will be the next to need a fix. A system that responds by itself, in seconds, is the best answer to that.
Rest assured, our tech team is constantly working to keep your platform fully up to date and secure.
Do you run PHP outside Vodlix?
If any of your own sites run PHP, take these steps today.
Find every server and hosting plan that runs PHP, old sites included.
Install the security update for your PHP version, or ask your host to.
Read your providers' advisories, such as the AWS security bulletin.
Questions?
If you have a security question, write to [email protected]. To see everything Vodlix runs and protects for your platform, visit our features page or request a demo.
Frequently asked questions
Do Vodlix customers need to do anything?
No. We patched before the issues were made public on October 21, 2026, and every Vodlix cloud, and so every customer platform, is up to date.
What were the PHP security issues?
Two critical issues in how PHP handles memory and errors, CVE-2026-109618 and CVE-2026-109619. Under the right conditions they could let an attacker run code on a web server without logging in.
What is Vodlix Shield?
Vodlix Shield is our own fast, lightweight tool, built specifically for PHP vulnerabilities and typical attack scenarios. It filters requests in front of our systems, and our AI monitoring watches traffic for attack patterns.
What is Vodlix doing next?
We keep adding techniques and improving our protection, and we are building a self-healing system that uses AI, so our technology can detect, recover from and protect itself against an incident before it needs a person.
How do I report a security issue to Vodlix?
Email [email protected].
Liked what you just read?
Subscribe to get the latest news, strategies, and insights on membership businesses delivered straight to your inbox.
