{"id":6920,"date":"2026-10-22T15:02:27","date_gmt":"2026-10-22T13:02:27","guid":{"rendered":"https:\/\/blog.simply.com\/?p=6920"},"modified":"2026-10-22T15:17:27","modified_gmt":"2026-10-22T13:17:27","slug":"php2shell","status":"publish","type":"post","link":"https:\/\/blog.simply.com\/en\/2026\/php2shell\/","title":{"rendered":"Critical PHP vulnerabilities fixed on all our servers"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">On 21 October 2026, two serious vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), also known as \u201cphp2shell\u201d, were made public. All our servers are now updated, and PHP 7.4 and all newer versions are fixed. You don\u2019t need to do anything.<\/p>\n\n\n\n<!--more-->\n\n\n\n<h3 class=\"wp-block-heading\">What is this about?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">PHP is the programming language that WordPress, WooCommerce and Joomla are built in, among others, and that most websites on a web hosting plan run on.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The two vulnerabilities can make it possible for an attacker to run their own code on a web server without logging in. The flaw is in PHP itself, not in a specific CMS or plugin. A website could therefore be exposed even if its own code was fully up to date and secure. The PHP project rates both flaws as critical and urges everyone to update immediately.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What we did<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Before the fixes were ready<\/strong>, we put temporary safeguards in place against the known attack methods on all our servers.<\/li>\n\n\n\n<li><strong>We installed the fixes the same day<\/strong> the PHP project released them. By 18:16 CEST, all our servers were running the fixed versions.<\/li>\n\n\n\n<li><strong>Afterwards<\/strong>, we removed the temporary safeguards again on the fixed versions, so everything runs as normal.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Which PHP versions are fixed?<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>PHP version<\/th><th>Status<\/th><\/tr><\/thead><tbody><tr><td>8.2, 8.3, 8.4 and 8.5<\/td><td>Fixed: updated to the latest official versions<\/td><\/tr><tr><td>7.4, 8.0 and 8.1<\/td><td>Fixed: the fix has been backported to your version<\/td><\/tr><tr><td>7.3 and older<\/td><td>Extra protection is enabled, but no official fix exists<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Using PHP 7.4, 8.0 or 8.1?<\/strong> The PHP project no longer maintains these versions. Because the vulnerabilities are so serious, it has made a fix for them anyway, and we have installed it. The fix has been backported to your existing version, so the version number may look unchanged, but your website is protected.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Using PHP 7.3 or older?<\/strong> No fix exists for versions this old. We have kept the extra protection in place, but it is no substitute for a fix, and we strongly recommend switching to a newer version.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Have you read about the vulnerabilities in the media?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerabilities have received a lot of coverage, and advice is being given to everyone who has a website. Here is what that advice means for you as a Simply.com customer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Does my website use PHP?<\/strong><br \/>If you have web hosting with us and your website is built with, for example, WordPress, WooCommerce or Joomla, it uses PHP. You can see which PHP version it uses in our control panel.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Do I need to update PHP myself or shut down my website?<\/strong><br \/>No. We update PHP on our servers, and that has already been done. You don\u2019t need to shut down your website.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Should I check whether anyone has accessed my website?<\/strong><br \/>It\u2019s always a good idea to keep an eye on your website. You can download the web server\u2019s log files in our control panel. See how in our <a href=\"https:\/\/www.simply.com\/en\/support\/faq\/php\/333-php-error-messages-logs-and-log-files\/\">guide to log files<\/a>. If you see content, files or users you didn\u2019t create yourself, or you\u2019re in doubt, contact our support.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Also remember to keep your CMS, plugins and themes up to date. That protects against the vast majority of attacks, including those that have nothing to do with PHP itself.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Do I need to do anything?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No, you don\u2019t need to do anything.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We do recommend always using a PHP version that the PHP project still maintains, i.e. PHP 8.2 or newer. Only those versions receive ongoing security fixes. You can switch PHP version yourself in our control panel. See how in our guide to PHP versions. Take a backup first, and check your website afterwards.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Stay updated<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">We have posted updates on the matter on our <a href=\"https:\/\/www.simply.com\/en\/serverstatus\/\">server status page<\/a>. You can also follow the status of our servers there at any time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you have questions, feel free to <a href=\"https:\/\/www.simply.com\/support\/\">contact our support<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>On 21 October 2026, two serious vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), also known as \u201cphp2shell\u201d, were made public. All our servers are now updated, and PHP 7.4 and all newer versions are fixed. You don\u2019t need to do anything.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[145,135],"tags":[146],"class_list":["post-6920","post","type-post","status-publish","format-standard","hentry","category-general-2","category-uncategorized","tag-php-3"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Critical PHP vulnerabilities fixed on all our servers - Simply.com blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.simply.com\/en\/2026\/php2shell\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Critical PHP vulnerabilities fixed on all our servers - Simply.com blog\" \/>\n<meta property=\"og:description\" content=\"On 21 October 2026, two serious vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), also known as \u201cphp2shell\u201d, were made public. All our servers are now updated, and PHP 7.4 and all newer versions are fixed. You don\u2019t need to do anything.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.simply.com\/en\/2026\/php2shell\/\" \/>\n<meta property=\"og:site_name\" content=\"Simply.com blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/simplycom\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-22T13:02:27+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-22T13:17:27+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blog.simply.com\/wp-content\/uploads\/2022\/11\/simply-logo-opengraph-wide.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Tom Sommer (Simply.com)\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@simplydotcom\" \/>\n<meta name=\"twitter:site\" content=\"@simplydotcom\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Tom Sommer (Simply.com)\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/blog.simply.com\\\/en\\\/2026\\\/php2shell\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/blog.simply.com\\\/en\\\/2026\\\/php2shell\\\/\"},\"author\":{\"name\":\"Tom Sommer (Simply.com)\",\"@id\":\"https:\\\/\\\/blog.simply.com\\\/#\\\/schema\\\/person\\\/75b6f03c345c3f5349bdaf25a3d56550\"},\"headline\":\"Critical PHP vulnerabilities fixed on all our servers\",\"datePublished\":\"2026-10-22T13:02:27+00:00\",\"dateModified\":\"2026-10-22T13:17:27+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/blog.simply.com\\\/en\\\/2026\\\/php2shell\\\/\"},\"wordCount\":642,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/blog.simply.com\\\/#organization\"},\"keywords\":[\"php\"],\"articleSection\":[\"General\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/blog.simply.com\\\/en\\\/2026\\\/php2shell\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/blog.simply.com\\\/en\\\/2026\\\/php2shell\\\/\",\"url\":\"https:\\\/\\\/blog.simply.com\\\/en\\\/2026\\\/php2shell\\\/\",\"name\":\"Critical PHP vulnerabilities fixed on all our servers - Simply.com blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/blog.simply.com\\\/#website\"},\"datePublished\":\"2026-10-22T13:02:27+00:00\",\"dateModified\":\"2026-10-22T13:17:27+00:00\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/blog.simply.com\\\/en\\\/2026\\\/php2shell\\\/\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/blog.simply.com\\\/#website\",\"url\":\"https:\\\/\\\/blog.simply.com\\\/\",\"name\":\"Simply.com blog\",\"description\":\"F\u00e5 de seneste nyheder om dom\u00e6ner og webhoteller her.\",\"publisher\":{\"@id\":\"https:\\\/\\\/blog.simply.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/blog.simply.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/blog.simply.com\\\/#organization\",\"name\":\"Simply.com\",\"url\":\"https:\\\/\\\/blog.simply.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/blog.simply.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/blog.simply.com\\\/wp-content\\\/uploads\\\/2022\\\/11\\\/simply-logo-opengraph-wide.png\",\"contentUrl\":\"https:\\\/\\\/blog.simply.com\\\/wp-content\\\/uploads\\\/2022\\\/11\\\/simply-logo-opengraph-wide.png\",\"width\":1200,\"height\":630,\"caption\":\"Simply.com\"},\"image\":{\"@id\":\"https:\\\/\\\/blog.simply.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/simplycom\",\"https:\\\/\\\/x.com\\\/simplydotcom\",\"https:\\\/\\\/www.linkedin.com\\\/simplycom\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/blog.simply.com\\\/#\\\/schema\\\/person\\\/75b6f03c345c3f5349bdaf25a3d56550\",\"name\":\"Tom Sommer (Simply.com)\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Critical PHP vulnerabilities fixed on all our servers - Simply.com blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.simply.com\/en\/2026\/php2shell\/","og_locale":"en_US","og_type":"article","og_title":"Critical PHP vulnerabilities fixed on all our servers - Simply.com blog","og_description":"On 21 October 2026, two serious vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), also known as \u201cphp2shell\u201d, were made public. All our servers are now updated, and PHP 7.4 and all newer versions are fixed. You don\u2019t need to do anything.","og_url":"https:\/\/blog.simply.com\/en\/2026\/php2shell\/","og_site_name":"Simply.com blog","article_publisher":"https:\/\/www.facebook.com\/simplycom","article_published_time":"2026-10-22T13:02:27+00:00","article_modified_time":"2026-10-22T13:17:27+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/blog.simply.com\/wp-content\/uploads\/2022\/11\/simply-logo-opengraph-wide.png","type":"image\/png"}],"author":"Tom Sommer (Simply.com)","twitter_card":"summary_large_image","twitter_creator":"@simplydotcom","twitter_site":"@simplydotcom","twitter_misc":{"Written by":"Tom Sommer (Simply.com)","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.simply.com\/en\/2026\/php2shell\/#article","isPartOf":{"@id":"https:\/\/blog.simply.com\/en\/2026\/php2shell\/"},"author":{"name":"Tom Sommer (Simply.com)","@id":"https:\/\/blog.simply.com\/#\/schema\/person\/75b6f03c345c3f5349bdaf25a3d56550"},"headline":"Critical PHP vulnerabilities fixed on all our servers","datePublished":"2026-10-22T13:02:27+00:00","dateModified":"2026-10-22T13:17:27+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.simply.com\/en\/2026\/php2shell\/"},"wordCount":642,"commentCount":0,"publisher":{"@id":"https:\/\/blog.simply.com\/#organization"},"keywords":["php"],"articleSection":["General"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/blog.simply.com\/en\/2026\/php2shell\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/blog.simply.com\/en\/2026\/php2shell\/","url":"https:\/\/blog.simply.com\/en\/2026\/php2shell\/","name":"Critical PHP vulnerabilities fixed on all our servers - Simply.com blog","isPartOf":{"@id":"https:\/\/blog.simply.com\/#website"},"datePublished":"2026-10-22T13:02:27+00:00","dateModified":"2026-10-22T13:17:27+00:00","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.simply.com\/en\/2026\/php2shell\/"]}]},{"@type":"WebSite","@id":"https:\/\/blog.simply.com\/#website","url":"https:\/\/blog.simply.com\/","name":"Simply.com blog","description":"F\u00e5 de seneste nyheder om dom\u00e6ner og webhoteller her.","publisher":{"@id":"https:\/\/blog.simply.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.simply.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/blog.simply.com\/#organization","name":"Simply.com","url":"https:\/\/blog.simply.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.simply.com\/#\/schema\/logo\/image\/","url":"https:\/\/blog.simply.com\/wp-content\/uploads\/2022\/11\/simply-logo-opengraph-wide.png","contentUrl":"https:\/\/blog.simply.com\/wp-content\/uploads\/2022\/11\/simply-logo-opengraph-wide.png","width":1200,"height":630,"caption":"Simply.com"},"image":{"@id":"https:\/\/blog.simply.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/simplycom","https:\/\/x.com\/simplydotcom","https:\/\/www.linkedin.com\/simplycom"]},{"@type":"Person","@id":"https:\/\/blog.simply.com\/#\/schema\/person\/75b6f03c345c3f5349bdaf25a3d56550","name":"Tom Sommer (Simply.com)"}]}},"_links":{"self":[{"href":"https:\/\/blog.simply.com\/en\/wp-json\/wp\/v2\/posts\/6920","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.simply.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.simply.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.simply.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.simply.com\/en\/wp-json\/wp\/v2\/comments?post=6920"}],"version-history":[{"count":2,"href":"https:\/\/blog.simply.com\/en\/wp-json\/wp\/v2\/posts\/6920\/revisions"}],"predecessor-version":[{"id":6924,"href":"https:\/\/blog.simply.com\/en\/wp-json\/wp\/v2\/posts\/6920\/revisions\/6924"}],"wp:attachment":[{"href":"https:\/\/blog.simply.com\/en\/wp-json\/wp\/v2\/media?parent=6920"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.simply.com\/en\/wp-json\/wp\/v2\/categories?post=6920"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.simply.com\/en\/wp-json\/wp\/v2\/tags?post=6920"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}