Over the past few days, the international web hosting community has been placed on high alert. Two critical vulnerabilities discovered in PHP, collectively dubbed "PHP2Shell", were publicly disclosed—putting millions of websites worldwide at risk. WordPress, Joomla, WooCommerce, PrestaShop, OpenCart, Laravel: virtually every modern website relies on PHP. Here is a breakdown of what occurred, why the industry is alarmed, and why AlphaServer clients are completely secure.
Key Takeaway: AlphaServer deployed official security updates across all servers on the very same day they were released (October 21, 2026). No action is required by our customers.
What Exactly Happened?
On October 21, 2026, the core PHP project issued urgent security advisories addressing two severe flaws with a critical severity score of 9.2 out of 10 (CVSS):
- CVE-2026-109618: Remote Code Execution (RCE) via Out-of-Memory memory corruption when PHP terminates requests mid-stream (such as during file upload processing).
- CVE-2026-109619: Remote Code Execution via stale internal request state persisting across process runs within the same worker.
In straightforward terms: an unauthenticated remote attacker can execute arbitrary system commands on the server without needing any login or valid credentials, gaining potential access to files, databases, and customer records.
Why the Global Urgency?
- All active PHP versions were affected prior to the release of these patches, impacting countless servers globally.
- Zero authentication required: Exploitation can be attempted remotely against standard public-facing PHP pages.
- Active exploitation and scanning across the internet were observed immediately surrounding disclosure.
- Legacy branches (PHP 8.1 and earlier) are officially End-of-Life (EOL) and receive no direct security fixes from the core PHP group.
- Major cloud and panel vendors (Google Cloud, AWS, Microsoft Azure, cPanel, Plesk) rushed to issue urgent advisories and WAF definitions.
Secure Patched PHP Versions
| PHP Branch | Patched Secure Version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
AlphaServer Took Immediate Action
We want to provide our clients with complete peace of mind: AlphaServer customers remain completely safe and protected.
From the first moment these vulnerabilities were disclosed, our technical engineering team responded proactively:
- Same-Day Updates: On October 21, 2026, the updated releases (8.5.12, 8.4.27, 8.3.36, and 8.2.35) were deployed across our server fleet.
- Legacy Protection: Patched builds for PHP 8.0 and 8.1 runtimes were also updated on our infrastructure to keep legacy customer apps secure.
- Seamless Service Reload: Server runtimes were restarted cleanly to immediately activate patched binaries with zero disruption.
- Continuous Traffic Monitoring: Intrusion prevention systems and edge firewalls are actively monitoring for scanning activity.
Customer security is not an afterthought for us—it has been our daily standard for over 30 years.
Do You Need to Take Any Action?
For all managed and shared hosting clients at AlphaServer, no action whatsoever is needed. Our infrastructure team has already handled everything on your behalf.
However, we always recommend the following best practices:
- If your web application still runs on PHP 8.1 or older, reach out to our team so we can assist in upgrading your site smoothly to PHP 8.2 or higher.
- If you manage an unmanaged VPS or Dedicated Server, ensure your packages are updated immediately or contact us for guidance.
- Always ensure your CMS plugins, extensions, and themes are kept up to date.
Should you have any questions or require custom assistance, our 24/7 technical team is always here for you at info@alphaserver.gr or +30 2313252414.
Need a rock-solid foundation for your project?
With 30+ years of experience, we deliver premium Web Hosting, VPS Servers, and Streaming solutions with 24/7 expert support.