PHP Security Update for Web, Agency and cPanel Hosting

Summary

PHP Security Update for Web, Agency and cPanel Hosting

PHP upgrades are now complete across all managed hosting servers. Following the PHP security update, some websites show PHP version 8.5.11 rather than 8.5.12. This is expected. The security fix has been added to the PHP version your website already uses, so the version number does not change. To confirm the fix is applied, go to hPanel → Websites → Dashboard and open PHP Info from the sidebar. If the Build Date is October 21, 2026 or later, your website has the fix. No action is needed from clients on our Web Hosting, Agency Hosting, or cPanel Hosting plans. VPS clients manage PHP themselves and can follow our guide: https://www.hostinger.com/blog/protecting-php2shell/

• Started

  Oct 21, 2026 · 5:44 PM

• Status

  Monitoring

• Duration

  Ongoing

• Severity

  Major

• ◆

  Identified

  Oct 21 · 5:44 PM Hostinger

  Our team is aware about ongoing PHP security vulnerabilities CVE-2026-109618 and CVE-2026-109619 (php2shell). After conducting tests in our hosting environments, we have confirmed out platform is not vulnerable php2shell. We additionally implemented an extra layer of protection to ensure attack vectors cannot be accessed. Although our environments are not affected, we will be rolling out patched PHP versions across our infrastructure. No actions are required from client side. We'll provide further updates soon. Thank you for your patience.

• ◆

  Identified

  Oct 21 · 7:12 PM Hostinger

  We have completed update work in our Agency Hosting infrastructure and continue working to finish PHP upgrades to remaining managed hosting servers. We'll provide further updates on progress. Thank you for your patience.

• ◆

  Identified

  Oct 22 · 3:34 AM Hostinger

  All cPanel servers have been updated to the latest cPanel build, which includes the PHP fix (build 138.18), and the latest Alt-PHP version.

• ◉

  Monitoring

  Oct 22 · 6:44 AM Hostinger

  PHP upgrades are now complete across all managed hosting servers. Following the PHP security update, some websites show PHP version 8.5.11 rather than 8.5.12. This is expected. The security fix has been added to the PHP version your website already uses, so the version number does not change. To confirm the fix is applied, go to hPanel → Websites → Dashboard and open PHP Info from the sidebar. If the Build Date is October 21, 2026 or later, your website has the fix. No action is needed from clients on our Web Hosting, Agency Hosting, or cPanel Hosting plans. VPS clients manage PHP themselves and can follow our guide: https://www.hostinger.com/blog/protecting-php2shell/