PHP2Shell Vulnerability
‼️
Impact: All sites / hosting environments using PHP
We are writing to inform you of PHP vulnerability that we are currently patching / mitigating. Expect further updates as information becomes available on this post.
What happened?
- PHP2Shell (CVE-2026-109618 and CVE-2026-109619) has been announced and a security release to address it is available.
- This release will patch the vulnerability for all sites using PHP 8.2 or later, but sites running PHP 8.1 or earlier will still be vulnerable.
Current Status
- Reclaim has put in place some temporary mitigation strategies via .htaccess rules.
- We will be deploying the security release across Shared Hosting, Managed Hosting, Domain of One's Own, and ReclaimEDU as soon as they are available for each platform.
- We are currently upgrading any Managed Hosting sites that are on PHP 8.1 or earlier to PHP 8.2.
Next Steps
- ACTION REQUIRED: If you are running a PHP site on Reclaim Cloud, you should redeploy your site to PHP 8.2 or later as soon as possible. We have a guide on this here: Changing PHP Versions Within The Topology Wizard
- Managed Hosting customers should check on their site's functionality if it was on PHP 8.1 or earlier, as it will have been forcibly upgraded to PHP 8.2
- Shared Hosting customers should not need to do anything, as PHP 8.1 and earlier have already been removed from the platform and we will be rolling out patches as they become available.
Contact our Support Team
If you have any further questions or need assistance, please contact our support team.
