PHP Security Update for Web, Agency and cPanel Hosting
Monitoring-
On October 23, 2026, the PHP project announced a new vulnerability (CVE-2026-115560). Websites on our Web Hosting, Agency Hosting, and cPanel Hosting plans are already protected by the mitigation applied on October 21. No action is needed. PHP's upcoming regular update will be applied as part of our normal maintenance and does not change your protection. VPS clients manage PHP themselves. If your VPS runs PHP, set session.upload_progress.enabled=0 in php.ini and restart PHP. If you already did this on October 21, no further action is needed. Guide: https://www.hostinger.com/blog/protecting-php2shell/
-
PHP upgrades are now complete across all managed hosting servers. Following the PHP security update, some websites show PHP version 8.5.11 rather than 8.5.12. This is expected. The security fix has been added to the PHP version your website already uses, so the version number does not change. To confirm the fix is applied, go to hPanel → Websites → Dashboard and open PHP Info from the sidebar. If the Build Date is October 21, 2026 or later, your website has the fix. No action is needed from clients on our Web Hosting, Agency Hosting, or cPanel Hosting plans. VPS clients manage PHP themselves and can follow our guide: https://www.hostinger.com/blog/protecting-php2shell/
-
All cPanel servers have been updated to the latest cPanel build, which includes the PHP fix (build 138.18), and the latest Alt-PHP version.
-
We have completed update work in our Agency Hosting infrastructure and continue working to finish PHP upgrades to remaining managed hosting servers. We'll provide further updates on progress. Thank you for your patience.
-
Our team is aware about ongoing PHP security vulnerabilities CVE-2026-109618 and CVE-2026-109619 (php2shell). After conducting tests in our hosting environments, we have confirmed out platform is not vulnerable php2shell. We additionally implemented an extra layer of protection to ensure attack vectors cannot be accessed. Although our environments are not affected, we will be rolling out patched PHP versions across our infrastructure. No actions are required from client side. We'll provide further updates soon. Thank you for your patience.