On this page
php2shell is the name researchers gave two critical flaws in PHP, made public on October 21, 2026. They could let an attacker run their own code on a web server, and sites around the world rushed to update. At Vodlix, our systems were protected and patched before the news broke, and our customers did not need to do anything.
What is php2shell?
php2shell is two related bugs in how PHP handles memory and errors, tracked as CVE-2026-109618 and CVE-2026-109619. Under the right conditions, an attacker could use them to run code on a server without logging in. The PHP Foundation rated them critical and released fixes on October 21, 2026.
The disclosure moved fast. Exploit attempts climbed into the millions within hours, and some government and commercial sites went offline as a precaution, as MediaNama reported.
How did Vodlix handle it?
We were protected on three fronts before anything could happen.
What | What it does |
|---|---|
Vodlix Shield | Filters incoming requests in front of our systems |
AI monitoring | Watches our traffic for attack patterns |
The patch | Applied before the flaws were made public |
Zain Jamil and our team patched the PHP in our middleware, the only part of Vodlix that uses PHP, ahead of the public release. Every Vodlix cloud, and so every customer platform, is updated. Customers did not need to take any action.
What happens next?
We have planned further hardening of our systems, so the next flaw like this meets more layers before it gets close. On a managed platform, security updates are our job, not yours.
What should you do if you run PHP yourself?
If any of your sites run PHP outside Vodlix, act today.
Find every server and hosting plan that runs PHP, old sites included.
Install the security update for your PHP version, or ask your host to.
Read your providers' advisories, such as the AWS security bulletin.
If a site runs a PHP version that no longer gets security updates, plan the upgrade now.
Want security handled for you?
If you would rather have updates like this handled for you, see what Vodlix runs for your platform or request a demo. Security questions go to [email protected].
Frequently asked questions
What is php2shell?
php2shell is two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619, made public on October 21, 2026. Under the right conditions they could let an attacker run code on a web server without logging in.
Were Vodlix customers affected?
No action was needed from Vodlix customers. We patched before the flaws were made public, and every Vodlix cloud, and so every customer platform, is updated.
What is Vodlix Shield?
Vodlix Shield filters incoming requests in front of our systems, and our AI monitoring watches traffic for attack patterns.
What should I do if I run PHP myself?
Install the security update for your PHP version, or ask your hosting provider to, and read your providers' advisories. Plan an upgrade for any site on a PHP version that no longer gets security updates.
How do I report a security issue to Vodlix?
Email [email protected].
Liked what you just read?
Subscribe to get the latest news, strategies, and insights on membership businesses delivered straight to your inbox.
