Hostinger PHP2Shell Protection: Security Update Explained Hostinger has deployed security protections against the critical PHP2Shell vulnerabilities that raised concerns across the global web hosting industry. The hosting provider
Hostinger has deployed security protections against the critical PHP2Shell vulnerabilities that raised concerns across the global web hosting industry. The hosting provider confirmed that it added firewall protections, introduced additional server-level safeguards, and completed PHP security updates across its managed hosting infrastructure.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, affect the PHP runtime used by many websites, including WordPress, WooCommerce, and other PHP-based applications. Under certain conditions, attackers could exploit these flaws to execute malicious code, access sensitive information, or disrupt website operations. Both vulnerabilities received a critical severity rating of 9.2 out of 10.
Hostinger says its platform protections were implemented after the vulnerabilities became public and exploit attempts began circulating. The company has advised customers using its managed hosting services that no manual action is required for these particular fixes, while VPS customers must check and secure their own PHP installations.
PHP2Shell refers to two critical vulnerabilities involving the way PHP handles memory and request processing when errors occur.
The first vulnerability, CVE-2026-109618, involves unsafe handling of internal data during memory exhaustion. The second, CVE-2026-109619, concerns memory that may be accessed after it has been released.
If successfully exploited, these flaws could potentially allow attackers to execute arbitrary code on vulnerable servers. This may lead to unauthorized access, data exposure, website modification, or service disruption.
Because the weaknesses exist in the PHP runtime itself, updating WordPress, themes, or plugins alone does not fix the underlying vulnerabilities. Administrators need a security-patched PHP build or an equivalent vendor-provided fix.
Hostinger outlined several measures designed to reduce the risk of PHP2Shell attacks.
Hostinger introduced security rules intended to detect and reject requests matching known exploit patterns. These rules provide an additional layer of defence against attacks targeting the PHP vulnerabilities.
However, firewall rules cannot guarantee protection against every possible variation of an attack. Applying the underlying PHP security fix remains essential.
The company also disabled PHP’s session upload progress functionality in certain hosting configurations and introduced safeguards for malformed upload requests.
These measures help reduce exposure to known attack paths associated with the vulnerabilities.
Hostinger rolled out PHP security fixes across its managed hosting infrastructure. According to its status updates, PHP upgrades were completed across managed hosting servers on October 22, 2026.
The provider also explained that some websites may continue to display their previous PHP version number because the security fix was added to the existing build. Customers can check the PHP build information in hPanel to confirm whether the fix has been applied.
The required response depends on the hosting service being used.
| Hostinger hosting plan | Recommended action |
|---|---|
| Web Hosting | No manual action required for the PHP2Shell fix, according to Hostinger |
| Cloud Hosting | No manual action required for the PHP2Shell fix |
| Agency Hosting | No manual action required for the PHP2Shell fix |
| cPanel Hosting | No manual action required for the PHP2Shell fix |
| VPS Hosting | Check and update PHP manually if the server runs PHP |
Hostinger manages the PHP runtime and security updates for its managed hosting plans. VPS customers, however, are responsible for maintaining their server software.
Even when a hosting provider manages updates, it is useful to verify the security status of a website.
Hostinger customers can follow these steps:
Hostinger says a build date of October 21, 2026, or later indicates that the PHP2Shell fix has been applied. The displayed PHP version number may remain unchanged because the security patch can be backported into an existing build.
If the information is unclear, contact Hostinger support and request confirmation that the PHP runtime serving the website is patched.
VPS customers have a different responsibility because they manage PHP on their own servers.
Hostinger recommends updating to an appropriate fixed PHP release and restarting PHP services. The listed patched releases are:
Administrators should verify compatibility with their applications and follow the provider’s instructions for their operating system and PHP installation.
If immediate patching is not possible, Hostinger recommends disabling session.upload_progress as a temporary mitigation and restarting PHP workers. This measure only addresses one of the vulnerabilities and is not a substitute for installing the complete fix.
VPS administrators should also review server logs, inspect unexpected file changes, maintain secure backups, and investigate suspicious activity.
WordPress uses PHP to run its core software, themes, and plugins. That makes the underlying PHP runtime an important part of website security.
A WordPress website may have updated plugins and a current version of WordPress but still depend on an outdated PHP environment.
Website owners should therefore:
These precautions help reduce risk, but they do not replace the security patch required for PHP2Shell.
No security measure can guarantee that every attack will be blocked.
Hostinger’s firewall rules and server-level safeguards add protection against known exploit patterns, while patched PHP builds address the underlying vulnerabilities. Customers should still follow their hosting provider’s guidance and investigate any evidence of compromise.
Website owners should also remember that PHP2Shell is not the only possible security risk. Outdated plugins, weak credentials, insecure server settings, and previously compromised files can present separate threats.
Hostinger’s response to PHP2Shell highlights the importance of combining proactive threat detection with timely software updates. The company has deployed firewall rules, introduced additional configuration safeguards, and completed security updates across its managed hosting infrastructure.
For customers using Hostinger’s Web, Cloud, Agency, or cPanel Hosting, no manual action is required for the PHP2Shell fixes described in its advisory. VPS users must check their PHP installations and apply the appropriate security updates themselves.
As PHP remains a core technology for millions of websites, the incident reinforces a key cybersecurity lesson: firewall protection is valuable, but keeping the underlying software patched is essential.
PHP2Shell is the name used for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could potentially allow remote code execution on vulnerable servers.
Hostinger reported that it completed security updates across its managed hosting infrastructure and deployed additional protections against known exploit attempts.
According to Hostinger, customers on its Web, Cloud, Agency, and cPanel Hosting plans do not need to take manual action for the PHP2Shell fix.
Yes. VPS customers manage their own PHP installations and should install an appropriate fixed release, then restart the relevant PHP services.
No. The vulnerabilities affect the PHP runtime. Updating WordPress, themes, and plugins is important, but it does not replace patching PHP.
Open PHP Info in hPanel and check the build information. Hostinger says a build date of October 21, 2026, or later indicates that the fix has been applied.
