A pair of critical PHP vulnerabilities has been making headlines worldwide this week, and we want GoGoGoHost customers to have clear, accurate information about what happened and what it means for their sites.
The short version
Both flaws — tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell” — have been patched across all GoGoGoHost servers. You don’t need to do anything to receive the fix.
What made these vulnerabilities serious
PHP2Shell consists of two runtime-level flaws, each rated 9.2 (Critical) under CVSS v4.0. Both permit unauthenticated remote code execution, and public proof-of-concept exploits are already circulating.
- CVE-2026-109618 involves memory corruption during out-of-memory cleanup, when request data is only partially initialized. It has been confirmed exploitable against Apache mod_php deployments.
- CVE-2026-109619 is a use-after-free caused by stale global state persisting after an abnormal request termination. It may allow memory disclosure of sensitive data or enable code execution.
Because both flaws live in the PHP runtime itself, updating your CMS, theme, or plugins does not remediate them. The fix must be applied at the PHP level.
How we responded
The PHP development team released official patches on October 21st, and our team deployed them across all GoGoGoHost infrastructure the same day.
The official fixes covered only PHP 8.2 through 8.5. For every other affected branch — PHP 5.4 through 8.1 — we applied community-provided backports or developed our own patches. Releases older than PHP 5.4 were not vulnerable to this disclosure.
What was patched
- All GoGoGoHost hosting — web hosting, semi-dedicated, OpenVZ, KVM, and dedicated servers
- All Managed Services deployments
Our recommendation
You’re protected from PHP2Shell, but unsupported PHP versions remain a broader security risk. New vulnerabilities are discovered regularly, and end-of-life branches no longer receive official fixes — which makes them prime targets. We suggest checking your PHP version in the GoGoGoHost control panel (PHP Selector) and upgrading if you’re running anything below 8.2. Our support team is happy to help with the upgrade at no cost.
PHP version support reference
Here is a quick reference guide on which PHP versions are currently supported and will continue to receive both support and security updates, and which PHP versions will no longer receive any updates:
| Release | Released | Active Support | Security Support |
|---|---|---|---|
| 8.5 | 11 months ago (20 Nov 2025) | Ends in 1 year and 2 months (31 Dec 2027) | Ends in 3 years (31 Dec 2029) |
| 8.4 | 1 year and 11 months ago (21 Nov 2024) | Ends in 2 months and 1 week (31 Dec 2026) | Ends in 2 years (31 Dec 2028) |
| 8.3 | 2 years and 11 months ago (23 Nov 2023) | Ended 9 months ago (31 Dec 2025) | Ends in 1 year and 2 months (31 Dec 2027) |
| 8.2 | 3 years and 10 months ago (08 Dec 2022) | Ended 1 year and 9 months ago (31 Dec 2024) | Ends in 2 months and 1 week (31 Dec 2026) |
| 8.1 | 4 years and 11 months ago (25 Nov 2021) | Ended 2 years and 11 months ago (25 Nov 2023) | Ended 9 months ago (31 Dec 2025) |
| 8.0 | 5 years and 11 months ago (26 Nov 2020) | Ended 3 years and 11 months ago (26 Nov 2022) | Ended 2 years and 11 months ago (26 Nov 2023) |
| 7.4 | 6 years and 11 months ago (28 Nov 2019) | Ended 4 years and 11 months ago (28 Nov 2021) | Ended 3 years and 11 months ago (28 Nov 2022) |
| 7.3 | 7 years and 10 months ago (06 Dec 2018) | Ended 5 years and 10 months ago (06 Dec 2020) | Ended 4 years and 10 months ago (06 Dec 2021) |
| 7.2 | 8 years and 11 months ago (30 Nov 2017) | Ended 6 years and 11 months ago (30 Nov 2019) | Ended 5 years and 10 months ago (30 Nov 2020) |
| 7.1 | 9 years ago (01 Dec 2016) | Ended 7 years and 10 months ago (01 Dec 2018) | Ended 6 years and 10 months ago (01 Dec 2019) |
| 7.0 | 10 years ago (03 Dec 2015) | Ended 8 years ago (04 Jan 2018) | Ended 7 years ago (10 Jan 2019) |
| 5.6 | 12 years ago (28 Aug 2014) | Ended 9 years ago (19 Jan 2017) | Ended 7 years ago (31 Dec 2018) |
| 5.5 | 13 years ago (20 Jun 2013) | Ended 11 years ago (10 Jul 2015) | Ended 10 years ago (21 Jul 2016) |
| 5.4 | 14 years ago (01 Mar 2012) | Ended 12 years ago (14 Sep 2014) | Ended 11 years ago (14 Sep 2015) |
| 5.3 | 17 years ago (30 Jun 2009) | Ended 15 years ago (30 Jun 2011) | Ended 12 years ago (14 Aug 2014) |
| 5.2 | 20 years ago (02 Nov 2006) | Ended 18 years ago (02 Nov 2008) | Ended 15 years ago (06 Jan 2011) |
| 5.1 | 20 years ago (24 Nov 2005) | Ended 20 years ago (24 Aug 2006) | Ended 20 years ago (24 Aug 2006) |
| 5.0 | 22 years ago (13 Jul 2004) | Ended 21 years ago (05 Sep 2005) | Ended 21 years ago (05 Sep 2005) |
Right now, official security updates are available only for PHP 8.2, 8.3, 8.4, and 8.5. Note that PHP 8.2 reaches its end-of-life on December 31, 2026.
While the affected older versions have been patched for these specific vulnerabilities, they remain unsupported and may contain other security issues.
We strongly recommend moving to a supported PHP version to reduce your risk and keep your site protected.
If you have any questions about the patch status of your account, just open a ticket — our team is ready to help.