October 2026 PHP vulnerabilities: don't panic, here's what to check

If you've come across the words "PHP2Shell," "critical vulnerability," or "urgent update" in recent days, you may have wondered whether your site was at risk. For the vast majority of you, the answer fits in one sentence: your host is taking care of it, and all you need to do is check that it's done.

Here, without unnecessary jargon, is what happened, what it means for a site built with WebAcappella Fusion, and the few checks that will give you peace of mind.

What happened

PHP is the language that powers, on the server side, a large share of websites: WordPress, Joomla, many online stores… and the dynamic features of WebAcappella sites, such as the contact form, the store, or restricted-access pages.

On October 21, 2026, the team that develops PHP released patched versions for two security vulnerabilities (references CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell"). They are considered serious, with a score of 9.2 out of 10, because they could allow an attacker to make a server execute their own instructions without needing a password.

The announcement seemed so sudden because information had leaked the day before, so PHP moved up the release of the fix by one day. Some security experts reported initial attack attempts, while others hadn't observed any yet: that's why hosts acted quickly. The patched versions are as follows:

• PHP 8.5: version 8.5.12
• PHP 8.4: version 8.4.27
• PHP 8.3: version 8.3.36
• PHP 8.2: version 8.2.35
• PHP 8.1 and earlier: no longer maintained by the PHP team. They are only patched if your host has adapted the fix itself.

Is your WebAcappella site affected?

These vulnerabilities are in PHP itself, meaning in the software installed on your host's server. They are not in WebAcappella Fusion, your project, or your site's content. They affect all sites hosted on a server where PHP is active, regardless of the tool used to create them.

A site published with WebAcappella always contains a few PHP files, even without a form or store. So there's no point trying to find out whether your site "uses" PHP: the only useful question is whether the server hosting it has been updated.

Shared hosting: your host does the work

Most WebAcappella sites are installed on shared hosting. In that case, PHP is maintained by the host, not by you: it's the host that installs the fix on its servers.

o2switch, for example, announced the rollout of the fixes across all its servers, applied automatically to every PHP version, and told its customers that no action was needed on their part.

Three checks for peace of mind

1. Check your host's announcements. Service status page, blog, social media, or customer email: most have communicated about it. If the announcement says the fix has been applied, there's nothing else you need to do for these vulnerabilities.
2. Check your site's PHP version. It's shown in your host's customer area, often in a section called "PHP version" or "PHP configuration." WebAcappella Fusion requires at least PHP 8.1. If your site is still running 8.1 or older, take the opportunity to switch to PHP 8.3 or 8.4, two versions that are still maintained. PHP 8.2, for its part, will no longer be maintained after December 31, 2026, so you might as well plan ahead.
3. If in doubt, ask your host. A simple message to their support is enough; here's a template you can adapt.

If you change PHP versions, run a quick test afterward: send yourself a message using your site's contact form and, if you have a store, go through it up to the payment page. If your site hasn't been republished in a long time, first republish it with a recent version of WebAcappella Fusion, compatible with PHP 8.1 to 8.5: this way, your site's server files will be up to date. And if something isn't right, switch back to the previous version while you contact us.

Do you manage your own server (VPS or dedicated)?

If you rent a virtual private server (VPS) or dedicated server and administer it yourself, the update is up to you: install the patched version of PHP, or the packages updated by your distribution, then restart the PHP services (PHP-FPM or Apache) so it takes effect. OVHcloud has published a step-by-step guide, useful whatever your provider.

What you don't need to do

• Tinker with your site's PHP configuration (the .user.ini file, for example). PHP states that this type of setting doesn't protect against these vulnerabilities: the fix happens at the server level.
• Download a "test script" or "fix" found online. Exploit code is circulating, and security researchers warn that some of it may contain malware.
• Reply to an alarmist email. High-profile security news always attracts fraudulent messages like "your site is vulnerable, click here." If in doubt, go through your host's customer area, never through a link you received.
• Rush to update WebAcappella Fusion. The vulnerability isn't in Fusion: no software update is needed to fix it, and your project doesn't need to be changed.

An advantage of WebAcappella sites: the original is on your computer

A site built with WebAcappella Fusion has a reassuring feature: its original doesn't live on the server, but in your project, on your computer. The live site is just a published copy. If you ever notice something unusual (a modified page, an unexpected redirect), contact your host so they can examine the server: your pages, meanwhile, can be republished from your project.

The only exception: if you have a store, orders and customer accounts are stored on the server. For this data, your host's backups take over, and it's useful to know how often they're made.

In summary

• Two serious vulnerabilities were fixed in PHP on October 21, 2026. They affect the server, not WebAcappella Fusion or your project.
• On shared hosting, your host applies the fix: simply check its announcement.
• Take the opportunity to check your PHP version: 8.3 or 8.4 are good choices; 8.1 and older versions are no longer maintained.
• On a VPS or dedicated server, update PHP and restart the PHP services.
• No tinkering and no scripts found online: updating the server is the only real fix.

Vulnerabilities like these are part of everyday life on the web: they're discovered, fixed, then rolled out. What matters is that the fix reaches your server quickly, and this time, hosts reacted as soon as it was released.

Sources

• php.net: official announcement of October 21, 2026, and temporary settings
• CVE-2026-109618 and CVE-2026-109619: PHP's detailed security advisories
• OVHcloud: guide for VPS and dedicated servers