A pair of severe PHP vulnerabilities, collectively dubbed “PHP2Shell,” has dominated security headlines worldwide in recent days, prompting an emergency response from the PHP development team.
The two flaws—CVE-2026-109618 and CVE-2026-109619—both carry a CVSS v4.0 severity score of 9.2 and enable unauthenticated remote code execution. Attackers can trigger them through specially crafted HTTP requests, potentially compromising sensitive data or executing arbitrary code with the privileges of the PHP worker process. The vulnerabilities were uncovered with the assistance of AI-assisted code analysis tools, and proof-of-concept exploit code has already circulated publicly.
Security patches for all supported PHP branches were rolled out on October 21st. These fixes are now live on our servers, and customers have nothing to do on their end. The official patches covered only PHP 8.2 through 8.5. For every other impacted version—spanning PHP 5.4 all the way to PHP 8.1—we have either deployed community-sourced fixes or written our own patches.
PHP releases older than 5.4 were not vulnerable to this specific threat.
Technical Details of the PHP2Shell Flaws
- CVE-2026-109618 (Out-of-Memory Handling Corruption):Â This vulnerability arises when PHP encounters an out-of-memory condition while internal request data is only partially initialized. During cleanup, PHP may incorrectly treat the incomplete data as valid, leading to memory corruption and enabling remote code execution. Researchers confirmed a working exploit against Apache mod_php deployments.
- CVE-2026-109619 (Stale Global State / Use-After-Free):Â This flaw occurs when PHP fails to properly reset internal global state after an abnormal request termination. A subsequent request handled by the same worker may reference memory that has already been freed, potentially allowing attackers to read sensitive information (such as passwords or API keys) or execute arbitrary code.
Both vulnerabilities reside in the PHP runtime itself, meaning updating a CMS, theme, or plugin does not remediate the underlying flaw.
What Has Been Updated
The patches apply to every hosting customer running the TrexHost Control Panel, including those on shared hosting, semi-dedicated, OpenVZ, KVM, and dedicated server plans.
The Growing Risk of Outdated PHP Versions
As AI-powered code analysis tools become more widely adopted, researchers are expected to uncover additional vulnerabilities in legacy software. Development teams, however, generally concentrate their resources on versions that are still officially supported—leaving older releases without official fixes.
This creates a dangerous situation: many websites still run outdated PHP versions, making them prime targets for attackers. Because these versions are no longer maintained, any newly discovered flaws may never be patched.
Below is a quick reference showing which PHP versions still receive support and security updates, and which have reached end-of-life:
| Release | Released | Active Support | Security Support |
|---|---|---|---|
| 8.5 | 11 months ago (20 Nov 2025) | Ends in 1 year and 2 months (31 Dec 2027) | Ends in 3 years (31 Dec 2029) |
| 8.4 | 1 year and 11 months ago (21 Nov 2024) | Ends in 2 months and 1 week (31 Dec 2026) | Ends in 2 years (31 Dec 2028) |
| 8.3 | 2 years and 11 months ago (23 Nov 2023) | Ended 9 months ago (31 Dec 2025) | Ends in 1 year and 2 months (31 Dec 2027) |
| 8.2 | 3 years and 10 months ago (08 Dec 2022) | Ended 1 year and 9 months ago (31 Dec 2024) | Ends in 2 months and 1 week (31 Dec 2026) |
| 8.1 | 4 years and 11 months ago (25 Nov 2021) | Ended 2 years and 11 months ago (25 Nov 2023) | Ended 9 months ago (31 Dec 2025) |
| 8.0 | 5 years and 11 months ago (26 Nov 2020) | Ended 3 years and 11 months ago (26 Nov 2022) | Ended 2 years and 11 months ago (26 Nov 2023) |
| 7.4 | 6 years and 11 months ago (28 Nov 2019) | Ended 4 years and 11 months ago (28 Nov 2021) | Ended 3 years and 11 months ago (28 Nov 2022) |
| 7.3 | 7 years and 10 months ago (06 Dec 2018) | Ended 5 years and 10 months ago (06 Dec 2020) | Ended 4 years and 10 months ago (06 Dec 2021) |
| 7.2 | 8 years and 11 months ago (30 Nov 2017) | Ended 6 years and 11 months ago (30 Nov 2019) | Ended 5 years and 10 months ago (30 Nov 2020) |
| 7.1 | 9 years ago (01 Dec 2016) | Ended 7 years and 10 months ago (01 Dec 2018) | Ended 6 years and 10 months ago (01 Dec 2019) |
| 7.0 | 10 years ago (03 Dec 2015) | Ended 8 years ago (04 Jan 2018) | Ended 7 years ago (10 Jan 2019) |
| 5.6 | 12 years ago (28 Aug 2014) | Ended 9 years ago (19 Jan 2017) | Ended 7 years ago (31 Dec 2018) |
| 5.5 | 13 years ago (20 Jun 2013) | Ended 11 years ago (10 Jul 2015) | Ended 10 years ago (21 Jul 2016) |
| 5.4 | 14 years ago (01 Mar 2012) | Ended 12 years ago (14 Sep 2014) | Ended 11 years ago (14 Sep 2015) |
| 5.3 | 17 years ago (30 Jun 2009) | Ended 15 years ago (30 Jun 2011) | Ended 12 years ago (14 Aug 2014) |
| 5.2 | 20 years ago (02 Nov 2006) | Ended 18 years ago (02 Nov 2008) | Ended 15 years ago (06 Jan 2011) |
| 5.1 | 20 years ago (24 Nov 2005) | Ended 20 years ago (24 Aug 2006) | Ended 20 years ago (24 Aug 2006) |
| 5.0 | 22 years ago (13 Jul 2004) | Ended 21 years ago (05 Sep 2005) | Ended 21 years ago (05 Sep 2005) |
Today, only PHP 8.2, 8.3, 8.4, and 8.5 are receiving official security updates. PHP 8.2 will reach its end-of-life on December 31, 2026.
While we have patched the recently disclosed PHP2Shell vulnerabilities in the affected older PHP versions, those releases are still unsupported and may contain other undisclosed security issues.
Our strong recommendation: migrate to a newer, supported PHP version to reduce your exposure to security risks and keep your site safeguarded. Our support team is available to assist with the upgrade process if needed.