PHP vulnerability: every PHP site updated and back online

Status: done. Every PHP site on Cubli is updated and back online. You did not need to do anything.

On 21 October two serious vulnerabilities in PHP became public: CVE-2026-109618 and CVE-2026-109619, also called “PHP2Shell”. Through these vulnerabilities an attacker could, under certain conditions, run their own code on a server with PHP. PHP is the programming language under WordPress, WooCommerce and Shopware, among others.

What we did

1. This morning, extra settings. On every PHP site we applied the settings that PHP and security companies advised.
2. From around 15:00, offline as a precaution. On the advice of CERT-EU and the NCSC, among others, we took every PHP site offline until the update was out. Databases, files and backups were kept.
3. From 16:00, the update. PHP released the fix at 16:00. The updated base for our servers was ready at 18:48, and the one for WordPress at 19:45.
4. From 20:00, updated and back online. All WordPress sites (WooCommerce too) now run on PHP 8.4.27 and the Shopware shops on PHP 8.5.12, the versions with the fix. Every WordPress site got a backup first and a check before and after. No site had to go back to the previous version. We checked per site that the new version runs.

Sites without PHP were not affected and stayed online the whole time.

What we learn from it

We had to wait a few hours for the updated PHP base for our servers. That is why we will build that base ourselves from now on. That way, with a next PHP fix, we no longer have to wait for someone else.

Questions

• Do I still need to do anything? No, not for your sites on Cubli. Do you also have sites with another host or on your own server? Ask there whether PHP has been updated.
• Did I lose anything? No. Your database, your files and your backups were kept.
• Another question? Mail info@cubli.io.