Guru Internet Services Responds to Critical PHP Security Threat with Proactive Server Updates

On October 21, 2026, the PHP project released urgent security fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, commonly referred to together as PHP2Shell. Guru Internet Services has completed the appropriate PHP security updates across all servers it manages for hosting customers.

The response reflects a central part of The Guru Way: paying close attention to technical details, applying practical solutions based on authoritative guidance, and addressing important infrastructure issues promptly rather than waiting for them to affect customers.

What happened with PHP2Shell?

PHP is a server-side programming language used by many websites and web applications, including WordPress. It works behind the scenes to process incoming requests, run application code, retrieve information, and generate the pages and features visitors use.

The official PHP security advisory states that the two PHP2Shell vulnerabilities can allow unauthenticated remote code execution. In plain language, a vulnerable server could potentially be made to run attacker-controlled code through a malicious web request, without requiring the attacker to sign in first.

The vulnerabilities involve two different failures in how PHP manages internal data and memory while processing requests:

• CVE-2026-109618 concerns memory handling during an out-of-memory condition. PHP may interrupt processing while internal request data is only partially initialized, after which cleanup operations may treat invalid data as legitimate.
• CVE-2026-109619 involves internal state remaining available after its underlying memory has been freed. A later request handled by the same PHP worker may use that stale state before normal initialization resets it.

The PHP project identified installations serving web requests through PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed as potentially affected. It assessed the risk as highest for mod_php because an unauthenticated request was demonstrated to trigger the vulnerability before application code runs.

Which PHP releases contain the fixes?

The upstream PHP project released the following patched versions:

• PHP 8.2.35
• PHP 8.3.36
• PHP 8.4.27
• PHP 8.5.12

Determining whether a particular server is protected may require more than comparing its displayed version number with this list. Linux distributions and long-term-support vendors sometimes backport security fixes into their own packages without adopting the corresponding upstream PHP version number.

PHP 8.1 and earlier branches no longer receive regular security updates from the PHP project. Some operating-system or long-term-support vendors may still supply backported patches, but administrators using older PHP branches need to confirm the status with the vendor or move to a supported release. The PHP project also advised that PHP 8.2 would reach end of life on December 31, 2026, making upgrade planning important even for systems patched to PHP 8.2.35.

This is not a WordPress core vulnerability

PHP2Shell affects the PHP runtime itself. It is not a newly discovered vulnerability in WordPress core, a plugin, or a theme. However, WordPress depends on PHP, so the server environment underneath a WordPress website still requires the appropriate PHP security update.

A WordPress security notice confirms that no WordPress update is required or planned specifically for these vulnerabilities. Instead, WordPress encouraged site owners to check with their hosting providers and update PHP as soon as possible where necessary.

This distinction is important for business website owners. Installing ordinary WordPress updates does not patch the server’s PHP runtime. WordPress maintenance and server software maintenance are separate responsibilities, and keeping one current does not eliminate the need to maintain the other.

Guru’s response for managed hosting customers

Guru Internet Services has performed the appropriate PHP security upgrades across the servers it manages for hosting customers. This server-level work addresses the PHP runtime rather than changing individual WordPress plugins, themes, or website content.

Prompt patching helps reduce the period during which newly disclosed vulnerabilities remain exposed. It is especially important in this case because the PHP project said updating is the only complete solution. Temporary configuration changes may reduce exposure to particular attack paths, but they do not make an unpatched installation safe.

Applying these updates is an important security control, but it should not be interpreted as a guarantee that every possible website or server risk has been eliminated. Responsible website security depends on continued maintenance across the hosting environment, application software, configurations, access controls, and other components.

What website owners should do

Customers whose websites are hosted on servers managed by Guru Internet Services do not need to install these server-side PHP patches themselves. Anyone with questions about the PHP version or hosting environment supporting their website may contact Guru Internet Services for clarification and any relevant follow-up.

Website owners who use another hosting provider should ask that provider whether the fixes for CVE-2026-109618 and CVE-2026-109619 have been applied. WordPress administrators can view the PHP version reported by their site under Tools > Site Health > Info > Server, although the visible number alone may not reveal whether a vendor has supplied a backported patch.

Organizations that manage their own servers should verify that the appropriate updated packages are installed and that running PHP workers are using the updated code. Environments on end-of-life PHP branches require particular attention because standard upstream security support is no longer available for those versions.

Proactive maintenance in practice

Critical infrastructure maintenance is often invisible to website visitors, but it remains essential to the security and reliability of business websites. Guru’s response to PHP2Shell demonstrates a proactive approach grounded in monitoring significant security developments, evaluating their relevance to managed systems, and acting on official remediation guidance.

The practical lesson for all website owners is that application updates and infrastructure updates must work together. A current WordPress installation still relies on a properly maintained PHP environment, and newly disclosed server vulnerabilities should be addressed as part of an ongoing maintenance process rather than only after a website shows signs of trouble.

Related Documents

• Read Guru PHP Security Bulletin (PDF)