Two critical vulnerabilities affecting PHP were publicly disclosed on October 21, 2026. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and commonly referred to together as PHP2Shell, can allow an unauthenticated attacker to execute code remotely under certain conditions.
Because PHP powers a large portion of the web, this is not a routine software notice. It requires prompt action, particularly for older websites running legacy content management systems, unsupported plugins or end-of-life versions of PHP.
What Monstrous Media Group has already done
Supported PHP environments within our managed hosting infrastructure have been patched. Our team is continuing to scan hosted websites, applications, extensions and legacy scripts for exposure or compatibility concerns.
Where a supported website or plugin requires a security update, we will apply or coordinate the appropriate patch. We are also reviewing older ExpressionEngine CMS installations and other legacy platforms that may depend on outdated PHP releases or abandoned software components.
Why older websites need additional review
Updating the server is an important first step, but it does not automatically make every legacy application safe. A website may still depend on an outdated PHP version, an unsupported CMS release, an abandoned extension or custom code that cannot operate correctly on a supported runtime.
PHP 8.1 and older no longer receive normal security updates from the PHP project. Some operating-system or extended-support vendors may provide backported fixes, but availability varies and does not remove the broader risk of running obsolete application software.
For older websites, changing PHP versions without testing can also cause pages, forms, administrative tools or integrations to stop working. That is why compatibility review, backups and functional testing are necessary before an upgrade is placed into production.
What happens if we identify an at-risk site
If our review identifies a website that can be safely patched, we will apply the available protection and continue monitoring it.
If a website is too old to patch safely, depends on end-of-life software or cannot be operated securely, it will need to be upgraded, rebuilt, isolated or taken offline immediately. The website owner will be contacted directly with the findings and the required next step.
A temporary shutdown is never our preferred outcome, but keeping a known vulnerable system publicly accessible can place the website, its data, its visitors and other connected services at risk. Security has to take priority over convenience when no reliable patch path exists.
What website owners should do now
- Do not ignore notices about PHP or CMS compatibility. They may indicate that your website is running software that no longer receives security support.
- Do not change the PHP version without a backup and compatibility test. Older websites can fail when moved directly to a modern runtime.
- Approve critical maintenance promptly. Delays can extend the time a vulnerable system remains exposed.
- Plan modernization for legacy websites. Emergency patching can reduce immediate risk, but it is not a long-term substitute for supported software.
- Contact MMG if you are unsure. We can review the hosting environment, PHP requirements, CMS version, extensions and practical upgrade options.
Patched PHP releases
The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address these vulnerabilities. The project states that updating is the only complete solution. Temporary configuration changes may reduce exposure to specific attack paths, but they should not be treated as a replacement for installing a patched release.
Our ongoing response
MMG will continue reviewing managed websites and legacy applications, applying available security updates and contacting affected owners when action is required. We will not leave a known, unpatchable public website online simply because it is old or difficult to update.
If you have an older website hosted or maintained by Monstrous Media Group and want to confirm its status, contact our team. We will review the environment and explain the next practical step in plain language.