| Date | Action |
|---|---|
| 21/10/2026 10:30:00 | Update: Hosted Power servers protected ahead of the PHP patch Technical details of two critical PHP vulnerabilities leaked today, ahead of the official PHP security release scheduled for 14:00 UTC (16:00 CEST). According to the security researchers who reproduced them, both are memory-corruption bugs (use-after-free) in PHP's session upload-progress handler, the part of PHP that processes file uploads and forms sent as multipart requests. PHP itself has not yet published the technical details. Why this is serious Based on what has been reported, no login or vulnerable plugin is needed. A single crafted upload request to any PHP page on a site can reach the affected code. PHP processes uploads before your application runs. WordPress, Magento, Shopware, Laravel or custom code never gets a chance to block it, and a web application firewall offers limited protection because the request looks like an ordinary upload. PHP rates both vulnerabilities as critical (CVSS 9.2). Security researchers report they can lead to remote code execution: an attacker could run their own code on the server and take over the website and its data. Reportedly every PHP version since 5.4 is affected, including older versions that will never get an official fix. PHP will publish the confirmed list with the release. What we did: we didn't wait for the patch This morning our engineers analysed the available information and built a custom PHP extension, hp_uploadprogress_guard. It disconnects the affected handler inside PHP itself, at startup, before any request comes in. That code can no longer run, whatever the PHP settings, .user.ini files or ini_set() calls in application code say. Built for every PHP version from 5.6 to 8.5, including end-of-life versions that will get no official patch, and tested on our platform. Rolled out today to every PHP version on every server of our managed platform, including cPanel and DirectAdmin servers. Uploads, forms, $_POST and $_FILES work exactly as before. The only visible effect was a short PHP-FPM restart. The one side effect: PHP's built-in session.upload_progress feature is turned off. Very few sites use it. Upload progress bars that run in the browser, which covers most modern ones, are not affected. The guard protects against the vulnerability as it has been described so far. As soon as PHP publishes the official details, we will verify that both issues are covered. Next steps When the official patched PHP versions are released, we install them through our normal update process. The guard stays in place as an extra layer, and it remains the only protection for PHP versions that no longer receive official updates. Do you need to do anything? No. Customers on PHP environments managed by Hosted Power don't need to do anything. If your site uses session.upload_progress, or you have questions, contact our support team. If you still run PHP 7.3 or older, this is a good time to plan an upgrade. We're happy to help. |
| 21/10/2026 11:22:00 | Dear Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), rated CVSS 9.2, have been reported. These vulnerabilities could potentially allow attackers to execute malicious code remotely. At Hosted Power, we acted before the official PHP patches became available. Our engineers developed and deployed a custom security extension, hp_uploadprogress_guard, which disables the vulnerable PHP functionality. The link: https://github.com/HOSTED-POWER/php_uploadprogress_guard This protection has already been deployed across our entire managed hosting platform, covering PHP versions 5.6 through 8.5, including unsupported versions. What does this mean for you? Your managed PHP environment is protected against the currently reported attack mechanism. Your websites, forms and file uploads continue to function normally. No action is required from you. What happens next? Our solution is a preventive mitigation, not a replacement for the official PHP patches. Once PHP releases its security updates, we will validate and deploy them to supported environments. We continue to monitor the situation closely and will keep you informed. Follow our updates: https://portal.hosted-power.com/status/ Kind regards, The Hosted Power Team |
| 21/10/2026 14:30:00 | Update on php2shell, as promised PHP has released the fixes (8.5.12, 8.4.27, 8.3.36 and 8.2.35) and published the details. The problem turned out to be broader than anyone could see this morning, and PHP says plainly there's no single workaround that covers everything. That's why we didn't rely on one seatbelt today. Throughout the day we added protection at several levels, so an attacker has to get past all of them: The official fix: we're rolling out PHP's patched versions across our platform as soon as they're available. Our web firewall keeps suspicious traffic away from PHP before it gets there. Automatic detection recognises the pattern of an attack attempt and blocks the source. Our open-source PHP extension grew during the day: besides the original fix it now has extra hardening layers and an emergency mode, for every PHP version from 5.6 to 8.5. No single layer replaces the official update, so please install it as soon as you can. If you're stuck on PHP 8.1 or older, ask your vendor for a backport or plan the upgrade now. Hosted Power customers don't need to do anything: we're on it. Thanks to everyone who checked our work today and pushed back. It made the result better. |
| 21/10/2026 15:55:00 | Resolved | Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) All supported Hosted Power-managed PHP environments have been successfully patched. Our Operations team responded proactively, implementing additional security measures and developing our own open-source mitigation before the official patches became available. Once released, the security updates were immediately deployed across our infrastructure. Additional protections remain active for legacy PHP environments, while we continue to evaluate permanent remediation options. Our infrastructure remains under active monitoring. No customer action is currently required. Thanks for your trust! The Hosted Power Team |
| 22/10/2026 14:11:00 | Update: additional in-house protection against two new PHP issues Following Wednesday's emergency PHP release, two new issues in PHP came to light, and PHP has not released fixes for either yet: A memory-safety bug in unserialize(), present in every PHP version, including the freshly patched releases (8.5.12, 8.4.27, 8.3.36 and 8.2.35). This is the issue behind recent reports that the PHP patch was "incomplete". It is considerably less severe than php2shell: it can only be exploited when an application processes untrusted data with unserialize(), or by code already running on the server. A crash introduced by the security release itself in PHP 8.4.27 and 8.5.12. Under certain conditions, SimpleXML frees the same memory twice ("zend_mm_heap corrupted"), which can take down a PHP worker and the websites it serves. PHP has approved a fix but has not released it yet. What we did Once again, we didn't wait. Within hours, our engineers extended our in-house PHP security extension, hp_uploadprogress_guard, to cover both issues. Version 3.2.1: isolates nested unserialize() calls so that freed memory can never be reused; applies PHP's approved SimpleXML fix from within the extension, on the two affected versions only. Both protections work on patched and unpatched PHP alike. We verified them with memory-analysis tooling on all affected PHP versions and against PHP's own test suites, with no change in behaviour for applications. As far as we know, no other hosting provider or vendor offers protection against these two issues today. As with our earlier work, we have published the extension as open source, so the wider PHP community can benefit too: https://github.com/HOSTED-POWER/php_uploadprogress_guard What this means for you Version 3.2.1 is being rolled out across our managed hosting platform as part of our standard update process. Your websites continue to work as before. No action is required from customers on PHP environments managed by Hosted Power. When PHP releases its official fixes, we will deploy them as usual. Our extension remains in place as an additional layer of protection. Thanks for your trust, The Hosted Power Team |