If you’ve seen alarming PHP security headlines this week, here’s the reassurance you need: every WebHostGo server has already received the fix. There is nothing you need to do.
The situation in brief
Two serious vulnerabilities in the PHP runtime — CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell” — were disclosed publicly this week. Each is rated 9.2 (Critical) under CVSS v4.0 and allows an attacker to run code remotely without logging in. Exploit code is already circulating, which explains the widespread coverage.
These are runtime-level bugs, not application bugs. That means patching your CMS, theme, or plugins will not help — the repair must happen inside PHP itself.
What WebHostGo did
On October 21st, the PHP project shipped official fixes. Our team applied them to all WebHostGo servers the same day.
Those official fixes only covered PHP 8.2 through 8.5. For the older branches still in use on some accounts — PHP 5.4 through 8.1 — we applied community backports or our own patches. Anything below PHP 5.4 was never exposed to this particular flaw.
Who is covered
- Every WebHostGo control panel account — web hosting, semi-dedicated, OpenVZ, KVM, and dedicated servers
- All cPanel Reseller Program nodes
- All Managed Services deployments
No customer action is required.
A worthwhile check
You’re safe from PHP2Shell, but old PHP versions are a lasting risk. Unsupported branches stop receiving official fixes, and new flaws appear regularly — which makes them prime targets. Take a moment to look at your PHP version in the WebHostGo control panel (PHP Selector). If it’s below 8.2, we recommend an upgrade, and our support team will handle it with you free of charge.
PHP version support reference
Here is a quick reference guide on which PHP versions are currently supported and will continue to receive both support and security updates, and which PHP versions will no longer receive any updates:
| Release | Released | Active Support | Security Support |
|---|---|---|---|
| 8.5 | 11 months ago (20 Nov 2025) | Ends in 1 year and 2 months (31 Dec 2027) | Ends in 3 years (31 Dec 2029) |
| 8.4 | 1 year and 11 months ago (21 Nov 2024) | Ends in 2 months and 1 week (31 Dec 2026) | Ends in 2 years (31 Dec 2028) |
| 8.3 | 2 years and 11 months ago (23 Nov 2023) | Ended 9 months ago (31 Dec 2025) | Ends in 1 year and 2 months (31 Dec 2027) |
| 8.2 | 3 years and 10 months ago (08 Dec 2022) | Ended 1 year and 9 months ago (31 Dec 2024) | Ends in 2 months and 1 week (31 Dec 2026) |
| 8.1 | 4 years and 11 months ago (25 Nov 2021) | Ended 2 years and 11 months ago (25 Nov 2023) | Ended 9 months ago (31 Dec 2025) |
| 8.0 | 5 years and 11 months ago (26 Nov 2020) | Ended 3 years and 11 months ago (26 Nov 2022) | Ended 2 years and 11 months ago (26 Nov 2023) |
| 7.4 | 6 years and 11 months ago (28 Nov 2019) | Ended 4 years and 11 months ago (28 Nov 2021) | Ended 3 years and 11 months ago (28 Nov 2022) |
| 7.3 | 7 years and 10 months ago (06 Dec 2018) | Ended 5 years and 10 months ago (06 Dec 2020) | Ended 4 years and 10 months ago (06 Dec 2021) |
| 7.2 | 8 years and 11 months ago (30 Nov 2017) | Ended 6 years and 11 months ago (30 Nov 2019) | Ended 5 years and 10 months ago (30 Nov 2020) |
| 7.1 | 9 years ago (01 Dec 2016) | Ended 7 years and 10 months ago (01 Dec 2018) | Ended 6 years and 10 months ago (01 Dec 2019) |
| 7.0 | 10 years ago (03 Dec 2015) | Ended 8 years ago (04 Jan 2018) | Ended 7 years ago (10 Jan 2019) |
| 5.6 | 12 years ago (28 Aug 2014) | Ended 9 years ago (19 Jan 2017) | Ended 7 years ago (31 Dec 2018) |
| 5.5 | 13 years ago (20 Jun 2013) | Ended 11 years ago (10 Jul 2015) | Ended 10 years ago (21 Jul 2016) |
| 5.4 | 14 years ago (01 Mar 2012) | Ended 12 years ago (14 Sep 2014) | Ended 11 years ago (14 Sep 2015) |
| 5.3 | 17 years ago (30 Jun 2009) | Ended 15 years ago (30 Jun 2011) | Ended 12 years ago (14 Aug 2014) |
| 5.2 | 20 years ago (02 Nov 2006) | Ended 18 years ago (02 Nov 2008) | Ended 15 years ago (06 Jan 2011) |
| 5.1 | 20 years ago (24 Nov 2005) | Ended 20 years ago (24 Aug 2006) | Ended 20 years ago (24 Aug 2006) |
| 5.0 | 22 years ago (13 Jul 2004) | Ended 21 years ago (05 Sep 2005) | Ended 21 years ago (05 Sep 2005) |
Today, official security updates are provided only for PHP 8.2, 8.3, 8.4, and 8.5. PHP 8.2 reaches end-of-life on December 31, 2026.
The older branches were patched against these specific flaws, but they remain unsupported and may carry other unresolved issues.
We strongly advise moving to a supported PHP version to lower your exposure and keep your site protected.
Questions about your account? Open a ticket and our team will take it from there.