PHP2Shell: CVE-2026-109618 and CVE-2026-109619

What happened, and how Hawk Host responded.

On October 21, 2026, PHP released updates addressing CVE-2026-109618 and CVE-2026-109619. These vulnerabilities allowed remote code execution (RCE) and were referred to as PHP2Shell. The announcement of the vulnerabilities was posted on October 20, 2026, and the first mitigation strategies were employed at Hawk Host, followed by patches for all PHP versions as they became available. All Hawk Host web hosting servers are secure at this time, but we wanted to provide additional details from the past 48 hours.

A Leaked Coordinated Release

Details emerged before the planned disclosure.

At the time of the announcement of the vulnerabilities, there was an intended coordinated release on October 21, 2026, at 14:00 UTC. Unfortunately, leaks occurred, and certain details were revealed ahead of the coordinated release.

Immediate Mitigations

Protection before patches were available.

At Hawk Host we use Imunify360 for all our web hosting servers and a variety of protections were employed:

• Web Application Firewall rules that blocked known attempted exploitations
• IP based reputation blocking, where an IP that attempted the exploit on one website would become blocked across the entire Imunify360 ecosystem
• On Hawk Host shared web hosting servers, we implemented global PHP.ini changes to provide further protection beyond what Imunify360 offered.

cPanel Update

Deployed the moment it went live.

On October 21, 2026, at exactly 14:00 UTC, cPanel released 138.0.18, updating their internal PHP to 8.4.27. Hawk Host shared web hosting servers automatically picked up the update, and our team verified that all servers were updated.

PHP Updates

CloudLinux HardenedPHP covered every version, including EOL releases.

All Hawk Host shared web hosting servers utilize CloudLinux and, with that, their HardenedPHP product. CloudLinux provides security fixes for end-of-life PHP versions via the HardenedPHP product. That meant CloudLinux was patching PHP from 5.6 all the way to 8.5. That work started at 14:00 UTC, and updates trickled in for approximately the next 12 hours as each version received patches. At this point in time, the following PHP versions are all updated:

• 5.6
• 7.0
• 7.1
• 7.2
• 7.3
• 7.4
• 8.0
• 8.1
• 8.2
• 8.3
• 8.4
• 8.5

PHP Version Numbers

CloudLinux backported fixes for both CVE-2026-109618 and CVE-2026-109619 to existing PHP versions, and had builds available for all supported versions. As a result, even though new PHP versions have been released, the initial builds remain on previous PHP versions, even when a new PHP release does exist.

CloudLinux intends to update the version numbers for 8.2, 8.3, 8.4, and 8.5 upon completion of builds for the recent Node.js security releases, which occurred on October 21, 2026.

The Update Process

Why some servers updated faster than others.

At Hawk Host, we can detect and deploy updates automatically. This is how we deployed both the cPanel and PHP updates. Unfortunately, due to the nature of the release, the mirrors, which are how we retrieve our updates, were under significant strain. Once updates were available, our systems ensured all servers received them. You may have found that, during this period, certain servers updated faster than others. Unfortunately, this was entirely out of our control. Our team, however, confirmed that all servers received the updates rather than simply assuming they did.

Virtual Private Servers

Self-managed servers need manual attention.

As we do not actively manage user Virtual Private Servers, we are unable to automatically perform updates or provide mitigation. Many control panels and environments provide auto-updates, which may have been applied. We also provide guidance on updating popular control panels in our knowledge base. If you have any questions about updating your server, please reach out to our support team.

Support

24/7 coverage through the entire rollout.

Before and after the PHP update, our team remained available 24/7. Our team continually updated our knowledge base article related to the PHP updates. In the background, our team also trained the Hawk Host Chat Assistant to provide up-to-date, relevant information, freeing up resources to continue supporting issues unrelated to the PHP updates.

Conclusion

In collaboration with our trusted partners and the entire team at Hawk Host, we took action to protect all shared web hosting users before and after PHP patches were made available. We appreciate everyone’s understanding during this time as continual system updates were released, increasing system load. Then, as well, everyone’s patience while we dealt with a significant increase in ticket and chat volume.