Two critical flaws in PHP itself, nicknamed PHP2Shell, let an attacker run their own commands on a web server without logging in. Every site hosted with Claude CMS was patched the same day. If you host Claude CMS yourself, check your PHP version today.
On 21 October 2026 the PHP team released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. Both are rated 9.2 out of 10. A working attack leaked before the fix was published, which is why some well-known shops took their websites offline that day, and why the UK’s National Cyber Security Centre issued an alert urging everyone to update.
PHP is the language that runs most of the web, including WordPress, Magento and Claude CMS. The flaws are in PHP itself, not in any one app, so every website running PHP 5.4 or later was affected, however well it was built.
Every time someone visits a page, PHP sets aside some memory for that request and tidies it up afterwards. An attacker could send an oversized upload that made PHP run out of memory halfway through setting a request up. The clean-up that followed went wrong: PHP could keep a pointer to memory it had already handed back, and the next visitor’s request on the same worker could pick up those leftovers.
By controlling what landed in that memory, an attacker could steer PHP into running their own commands. It all happens while PHP is still reading the request, before your site’s code starts, so no login was needed and any page on the server was a way in. Running commands on a server means full control of it: the database, customer details and every file.
If Claude CMS hosts your site, you don’t need to do anything. We installed the fixed PHP builds across our hosting servers on 21 October and restarted PHP so no old processes were left running. Every hosted site now runs PHP 8.3.36 or 8.5.12. Your site, store and checkout carried on working throughout.
Following the update, we carried out a full review of our server log files: PHP crash and error logs, web server access logs, recently changed files and scheduled tasks. We found no evidence or signs that the flaw was exploited on any site we host.
If Claude CMS runs on your own hosting (GoDaddy, Hostinger, Bluehost, SiteGround, your own server and so on), the fix has to come from your host, because PHP belongs to the server rather than to your site. Today:
8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer. The exact number matters: 8.3.35 is still vulnerable, 8.3.36 is not.Not sure where to look? Raise a support ticket and we’ll help you check.
If you manage the server yourself, update PHP from the same place it was installed, then restart PHP so nothing keeps running the old code. Swap 8.3 for the version you use.
apt update && apt install --only-upgrade 'plesk-php8*'
systemctl restart plesk-php83-fpm apache2sudo apt update && sudo apt install --only-upgrade 'php8.3*'
sudo systemctl restart php8.3-fpm apache2sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm httpdyum update 'ea-php*'
/scripts/restartsrv_apache_php_fpmLeave out apache2 or httpd if you only run nginx. Then check the version with php -v, and on a page of your site as well: the command line and the web server can use different PHP builds. If you use your Linux distribution’s own PHP packages, it may patch them without changing the version number, so check its security notice for CVE-2026-109618 instead.
Server security updates like this are part of Claude CMS hosting. We watch for them, apply them and check every site afterwards, so you hear about the next one from us after it’s already fixed.