Three PHP vulnerabilities have raised serious security concerns for website owners and VPS administrators. Here’s what happened, which versions need updates, and why CyberPanel users should pay attention.
Running a website comes with an uncomfortable reality: even when everything seems to be working perfectly, the software keeping it online may be vulnerable.
That became painfully clear on October 21, 2026, when the PHP development team released emergency security updates addressing two critical vulnerabilities.
The flaws, identified as CVE-2026-109618 and CVE-2026-109619, received CVSS severity scores of 9.2 out of 10. Both could potentially allow attackers to execute malicious code remotely without authentication.
Then, on October 23, a third vulnerability, CVE-2026-115560, added another concern for server administrators.
Hosting provider Hostinger issued warnings and deployed protections across its managed infrastructure. But customers running self-managed virtual private servers, or VPS instances, faced a different situation.
And here’s the part many website owners overlook: updating WordPress doesn’t automatically update the PHP installation running underneath it.
What Happened to PHP?
The first two vulnerabilities, collectively known as php2shell, involve problems with how PHP handles memory and internal request data.
CVE-2026-109618 concerns memory corruption during out-of-memory conditions. If PHP runs out of memory while processing a request, internal data structures may be left in an inconsistent state.
CVE-2026-109619 involves internal state referencing memory that has already been released. Under certain circumstances, this can create opportunities for malicious behavior.
Both vulnerabilities are particularly serious because exploitation may lead to remote code execution.
That means an attacker could potentially run commands on a vulnerable server without first gaining access to an administrator account.
We’re not talking about an outdated WordPress plugin or an abandoned theme. These vulnerabilities affect PHP itself, the runtime responsible for processing millions of websites and web applications.
Even a fully updated website may remain exposed if its underlying PHP installation is vulnerable.
Which PHP Versions Are Affected?
On October 21, the PHP project released security updates for four supported branches.
The patched versions are:
PHP 8.2.35, PHP 8.3.36, PHP 8.4.27, and PHP 8.5.12.
Administrators running earlier builds within these branches should install the corresponding security updates or newer patched releases.
Older, unsupported PHP versions also deserve immediate attention. Applications still relying on PHP 7.4, 8.0, or 8.1 may lack official upstream security maintenance. And compatibility is not the same thing as security.
A website continuing to function on outdated software doesn’t mean that software is safe to expose to the internet.
PHP 8.2 is also approaching its end of life, scheduled for December 31, 2026. Administrators still using that branch should prepare a migration plan.
A Third PHP Vulnerability Emerged
On October 23, the PHP project disclosed CVE-2026-115560, a separate issue involving session upload progress tracking.
Unlike the first two critical flaws, this vulnerability requires an unusual combination of application behavior and PHP configuration.
Specifically, exploitation involves changes to the session serialization handler during execution while session upload progress remains enabled.
The PHP security team described the attack scenario as unlikely in typical applications. However, it still recommended a temporary mitigation until a regular bugfix release becomes available.
The recommended setting is:
session.upload_progress.enabled = OffAdministrators can apply this configuration in the appropriate php.ini file or supported PHP runtime configuration.
Afterward, the relevant PHP processes must reload the updated settings.
There’s an important catch: changing this option inside application code using ini_set() is not an effective mitigation.
For most websites, disabling session upload progress tracking should not interfere with ordinary file uploads, although applications that depend on the feature should be tested.
And remember, this configuration does not replace the security updates required for the first two vulnerabilities.
Why VPS Owners Face Additional Risks
Hostinger reported deploying PHP updates, firewall protections, and configuration changes across its managed hosting infrastructure.
By October 22, the company said the patches for the first two vulnerabilities had been installed on its managed hosting servers.
Self-managed VPS customers, however, generally remain responsible for maintaining their own operating systems, software packages, and PHP environments.
This distinction matters more than many people realize.
Paying for a VPS gives you control over the server. It doesn’t necessarily mean someone else is monitoring and installing every security update.
The server is yours. So is the responsibility.
This is particularly important for administrators using control panels such as CyberPanel alongside OpenLiteSpeed.
CyberPanel and OpenLiteSpeed: Check the PHP Version Actually Running
CyberPanel commonly uses OpenLiteSpeed, which supports multiple PHP versions through its LiteSpeed Server Application Programming Interface, or LSAPI.
That flexibility is useful, especially when hosting applications with different compatibility requirements.
But it can also create confusion during security updates.
For example, a VPS might report PHP 7.4 when an administrator runs php -v over SSH, even though its websites actually use PHP 8.5.
The command checks the PHP executable available in the command-line environment. It doesn’t necessarily identify the version handling incoming web requests.
During a recent CyberPanel environment review, we found seven installed PHP versions, ranging from 7.4 through 8.5.
However, both websites hosted on that server were configured to use PHP 8.5.
We confirmed this by examining OpenLiteSpeed processes and configuration records associated with each domain.
This distinction matters because updating the wrong PHP installation can leave the actual web environment vulnerable.
How to Secure a CyberPanel VPS
Before making changes, identify which PHP versions are installed and which ones your websites actively use.
With OpenLiteSpeed, version-specific configuration files may be located in directories such as:
/usr/local/lsws/lsphp85/etc/php.iniThe exact location depends on the installed version and server configuration.
Back up the relevant configuration files before modifying them.
To apply the temporary mitigation for CVE-2026-115560, explicitly disable session upload progress tracking:
session.upload_progress.enabled = OffBe careful with commented configuration lines.
For example:
;session.upload_progress.enabled = OnThe semicolon means the directive is commented out. It does not necessarily mean the feature is disabled.
After saving the configuration, ensure the PHP workers handling your websites reload the updated settings.
OpenLiteSpeed and LSAPI environments don’t always follow the same process management procedures as PHP-FPM installations, so use the appropriate method for your setup.
Finally, verify the effective PHP configuration from the web runtime rather than relying exclusively on the contents of a configuration file.
And install the patched PHP release for your supported branch.
Disabling upload progress is an additional precaution, not a substitute for patching.
Can Restarting PHP Temporarily Slow Down a Website?
While applying security changes to a CyberPanel server, we observed something worth mentioning.
After restarting the PHP processes, the hosted websites experienced temporary slowdowns.
OpenLiteSpeed logs indicated that older processes had stopped and replacement processes were starting.
CPU usage remained low, sufficient memory was available, and the logs we reviewed showed no critical errors.
Shortly afterward, the websites appeared to return to normal operation. This doesn’t mean every PHP restart causes performance issues.
However, restarting application workers can temporarily affect response times while processes initialize and caches warm up.
That’s why production changes should be followed by monitoring.
Repeatedly restarting a server without investigating the underlying behavior can make troubleshooting harder rather than solve the problem.
Why a Firewall Isn’t Enough
Hostinger also implemented firewall rules designed to block known exploitation patterns.
These protections can reduce exposure, particularly during the period between vulnerability disclosure and patch deployment.
But a firewall doesn’t repair vulnerable PHP code.
If attackers discover another exploitation method that bypasses existing filtering rules, the underlying problem may still be present.
Security works best through multiple layers: patched software, hardened configurations, restricted access, reliable backups, and ongoing monitoring.
Depending on a single protective measure is a risky strategy.
What Happens Next?
As of October 28, 2026, CVE-2026-115560 was awaiting a fix in an upcoming regular PHP release.
The PHP project recommended temporarily disabling session upload progress tracking in potentially affected environments while administrators monitor official updates.
The first two vulnerabilities are different: patched PHP releases are already available, and the project has emphasized that updating is the only complete solution.
For VPS administrators, the immediate priority is to verify the actual PHP runtime used by each website and confirm that the relevant security updates are installed.
For anyone still using PHP 8.2, the approaching end-of-life deadline provides another reason to plan ahead.
Website Security Starts Below WordPress
These vulnerabilities highlight a problem that often goes unnoticed until something breaks.
Website security isn’t just about installing WordPress updates, enabling HTTPS, or choosing a reputable hosting provider.
It also requires understanding the infrastructure supporting the application.
Which PHP version is actually running? Who maintains it? How are security updates deployed? And what happens when a critical vulnerability is disclosed? For self-managed VPS owners, those aren’t optional questions.
After all, there’s little value in spending time and money building a website while leaving the server underneath it exposed.
And when it comes to cybersecurity, learning about a vulnerability from an official security advisory is always preferable to discovering it after an attacker has already found a way in.
