Security

Reclaiming the PHP2Shell : All You Need to Know

Taylor Jadin

Taylor Jadin

— 3 min read
Share
Reclaiming the PHP2Shell : All You Need to Know

On October 20, 2026, PHP pre-announced a security release for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two critical vulnerabilities affecting any site running PHP. The release shipped on October 21 and only covered 8.2 and later, leaving anything on PHP 8.1 or older without an upstream patch. The patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

We saw no evidence that PHP2Shell was exploited on our servers, and within one day of the security release, all Shared Hosting and Managed Hosting environments were patched. The patch is also available on Reclaim Cloud and customers using PHP should redeploy to a patched version of PHP immediately.

Timeline

  • Oct 20
  • Oct 21
    • We announce our response: .htaccess mitigations in place.
    • PHP publishes the security release, patching 8.2 and later only. Reclaim team begins rolling out patches, Managed Hosting sites on PHP 8.1 or older upgraded to 8.2.
    • We announce accelerated DoOO v2 migrations; about 34 schools were moved in bulk so they can be brought on to PHP 8.2 immediately.
  • Oct 22
    • Virtuozzo releases patched PHP containers for Reclaim Cloud; we ask customers to redeploy to PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 by Oct 27.
  • Oct 27
    • Reclaim Cloud customer redeploy deadline. Any containers running older vulnerable versions of PHP are still being redeployed by the Reclaim team.

What we did

How much work each platform needed came down to one thing: how much old PHP was still on it.

  • Shared Hosting
    • What we did: Rolled out patched PHP as it became available. PHP 8.1 and older had already been removed.
    • What customers had to do: Nothing.
  • Managed Hosting / ReclaimEDU
    • What we did: Patched all sites, including those running on Reclaim Cloud. Upgraded any site on PHP 8.1 or older to 8.2.
    • What customers had to do: Check site functionality if it had been on 8.1 or older.
  • Domain of One's Own
    • What we did: Moved about 34 schools from the original platform to DoOO v2, which drops old PHP and defaults to 8.2. For schools that rely on WHMCS for apex domains, we upgraded WHMCS to versions that run on patched PHP and/or applied the backported patch for PHP 7.4–8.1.
    • What customers had to do: Log in to your DoOO portal and get familiar with the DoOO v2 by checking out our docs.
  • Reclaim Cloud
    • What we did: Made patched builds available (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35).
    • What customers had to do: Redeploy PHP environments to a patched version. The Oct 27 deadline has passed, so any environments using an older version of PHP will be redeployed.

Going forward: staying on supported PHP

Staying on supported PHP versions makes the next vulnerability and patch a non-event. In the past Reclaim has often kept older versions of PHP available for compatibility reasons, however in today's security landscape we are no longer able to offer this. Reclaim will now remove PHP versions as they reach end of life on PHP's Supported Versions page. Each PHP branch gets two years of active support and two more of security-only fixes, then reaches end of life. We'll still announce every PHP removal here on the blog, but you don't have to wait for us: that page shows when your version's support ends, so you can plan upgrades on your own schedule.

Where things stand

Shared Hosting, Managed Hosting, ReclaimEDU and Domain of One's Own are patched, including the WHMCS-dependent schools. Reclaim Cloud container updates are available and customers that run their own PHP environment there should redeploy immediately. Any environments still running old versions of PHP will be redeployed without warning by the Reclaim team.

If you are having any issues with your site after these changes, please contact our support team.

Read more