UPDATE 4: Releases from Cloudlinux and cPanel helped patch also versions 7.4 8.0 8.1, while patched we do recommend migrating websites running on this PHP versions as soon as possible.
_____________________________________________________________________________________
UPDATE 3: Direct Admin servers are patched now, the Anti-bot check-up thresholds have been decreased to reduce the impact on user interactions.
_____________________________________________________________________________________
UPDATE 2: DirectAdmin servers: updates are underway / Interim mitigation: Imunify360 ModSecurity ruleset 8.84 (stable) blocks the known exploit pattern; servers with Imunify360 WAF enabled receive it automatically.
_____________________________________________________________________________________
UPDATE 1: cPanel servers: are now patched for PHP 8.1-8.5 , EOL versions 7.4 8.0 8.1 might also receive patches – patches are installed once they become available.
_____________________________________________________________________________________
Following the recent php2shell vulnerability (CVE-2026-109618, CVE-2026-109619) announcement (detailed at https://www.php.net/archive/2026.php#2026-10-21-5), we are patching all cPanel and DirectAdmin servers across our infrastructure.
To keep your accounts safe while patches are applied, we have put temporary protections in place.
Temporary Changes Enforced
* Upload Functions Off: Features linked to the exploit, including php_session_upload and multi-part handling, are temporarily turned off on active PHP versions.
* Anti-Bot measures: Anti-bot protection and interactive reCaptcha thresholds are increased globally on servers to block automated attack traffic.
* PHP 5.1, 5.2, and 5.3 Removed: These versions are too old to support target function disables. They are permanently shut down and will not return.
Required Upgrades & Workarounds
If your site was running PHP 5.1 to 5.3, you must update your code to PHP 5.4 or higher to run.
However, we recommend updating directly to PHP 8.2 or newer. Older versions are past End-of-Life (EOL) and no longer get standard security fixes.
If you cannot update to PHP 8.2 immediately:
Set up Cloudflare or another Web Application Firewall (WAF) that blocks this specific exploit (reference: https://blog.cloudflare.com/php-vulnerabilities-waf-protection/ . A WAF is only a short-term workaround. Plan your codebase update right away.
Next Steps
As soon as vendor patches finish installing across all cPanel and DirectAdmin hosts:
* php_session_upload and related functions will be turned back on.
* Server anti-bot and reCaptcha protections will be turned off.
Thank you for your patience while we secure the environment.
Note for VPS owners – please check your environment if PHP is installed and take the appropriate measures to upgrade to the patch installed PHP versions to secure your websites.