On 21 October 2026, two serious vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), also known as “php2shell”, were made public. All our servers are now updated, and PHP 7.4 and all newer versions are fixed. You don’t need to do anything.
What is this about?
PHP is the programming language that WordPress, WooCommerce and Joomla are built in, among others, and that most websites on a web hosting plan run on.
The two vulnerabilities can make it possible for an attacker to run their own code on a web server without logging in. The flaw is in PHP itself, not in a specific CMS or plugin. A website could therefore be exposed even if its own code was fully up to date and secure. The PHP project rates both flaws as critical and urges everyone to update immediately.
What we did
- Before the fixes were ready, we put temporary safeguards in place against the known attack methods on all our servers.
- We installed the fixes the same day the PHP project released them. By 18:16 CEST, all our servers were running the fixed versions.
- Afterwards, we removed the temporary safeguards again on the fixed versions, so everything runs as normal.
Which PHP versions are fixed?
| PHP version | Status |
|---|---|
| 8.2, 8.3, 8.4 and 8.5 | Fixed: updated to the latest official versions |
| 7.4, 8.0 and 8.1 | Fixed: the fix has been backported to your version |
| 7.3 and older | Extra protection is enabled, but no official fix exists |
Using PHP 7.4, 8.0 or 8.1? The PHP project no longer maintains these versions. Because the vulnerabilities are so serious, it has made a fix for them anyway, and we have installed it. The fix has been backported to your existing version, so the version number may look unchanged, but your website is protected.
Using PHP 7.3 or older? No fix exists for versions this old. We have kept the extra protection in place, but it is no substitute for a fix, and we strongly recommend switching to a newer version.
Have you read about the vulnerabilities in the media?
The vulnerabilities have received a lot of coverage, and advice is being given to everyone who has a website. Here is what that advice means for you as a Simply.com customer.
Does my website use PHP?
If you have web hosting with us and your website is built with, for example, WordPress, WooCommerce or Joomla, it uses PHP. You can see which PHP version it uses in our control panel.
Do I need to update PHP myself or shut down my website?
No. We update PHP on our servers, and that has already been done. You don’t need to shut down your website.
Should I check whether anyone has accessed my website?
It’s always a good idea to keep an eye on your website. You can download the web server’s log files in our control panel. See how in our guide to log files. If you see content, files or users you didn’t create yourself, or you’re in doubt, contact our support.
Also remember to keep your CMS, plugins and themes up to date. That protects against the vast majority of attacks, including those that have nothing to do with PHP itself.
Do I need to do anything?
No, you don’t need to do anything.
We do recommend always using a PHP version that the PHP project still maintains, i.e. PHP 8.2 or newer. Only those versions receive ongoing security fixes. You can switch PHP version yourself in our control panel. See how in our guide to PHP versions. Take a backup first, and check your website afterwards.
Stay updated
We have posted updates on the matter on our server status page. You can also follow the status of our servers there at any time.
If you have questions, feel free to contact our support.
