Help Center
Home Hosting PHP

PHP2Shell security vulnerability - important information regarding your IONOS contract

Valid for: All applications and services that use PHP

On October 21, 2026, the PHP project released security updates that fix two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in the core runtime of the widely used PHP scripting language.

Together, these two vulnerabilities are known as PHP2Shell. They allow attackers to execute malicious code and take over the web server without authentication or user interaction. This article provides background information, explains how to check for a possible compromise, and describes the steps you should take.

Key points at a glance

  • IONOS has already installed the official PHP updates on its systems.
  • Most customers do not need to take any action.
  • If you run PHP yourself, for example on a VPS or a Dedicated Server, you must take action immediately.

Warning: Phishing!

Experience shows that fraudsters also exploit incidents that receive as much media attention as PHP2Shell. They send fake emails to obtain login details or try to trick you into revealing sensitive information in other ways.

  • Use the Validation Service to check whether emails claiming to be from IONOS are genuine.
  • Do not run any scripts on your server that do not come from trusted sources.

Change your PHP version in your IONOS account

If you can change your PHP version in your IONOS account, you are not at risk from PHP2Shell, because IONOS manages these PHP versions and keeps them up to date. IONOS has also applied the necessary security updates to PHP versions that are no longer officially supported by the PHP community, so you can continue to use your current PHP version securely (see the section PHP versions covered by IONOS PHP Extended Support below).

To change the PHP version, log in to your IONOS account, click Hosting, and then click Manage in the PHP tile. On the PHP Settings page, select the domain, click Change PHP version, select one of the available versions, and click Save. The currently recommended version is marked accordingly.

PHP versions covered by IONOS PHP Extended Support

IONOS has also applied the PHP2Shell security updates to the older PHP versions that it continues to provide as part of IONOS PHP Extended Support. If you use one of these versions, you are protected against PHP2Shell and do not need to take any immediate action.

The security updates cover the following PHP versions:

  • PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0, and 8.1 (all hosting packages)
  • PHP 4.0, 5.2, 5.4, and 5.5 (only hosting packages ordered on or before September 14, 2025)

Note

The following information is mainly intended for IONOS customers who run their own PHP, for example on a Dedicated Server, or who use integrations that include their own PHP.

If you use PHP provided by IONOS, for example to run a CMS such as WordPress, you are already protected by internal IONOS updates (see the section Change your PHP version in your IONOS account above).

If you are running your own PHP server

IONOS has already updated its own PHP infrastructure and implemented additional security measures. This does not cover PHP installations that you operate yourself. In such cases, you must take action immediately.

A small audience or a low profile does not protect you as a server operator. Attackers have automated the search for web servers that are vulnerable to PHP2Shell, so even lesser-known websites are being targeted.

In addition to executing malicious code, attackers can exploit PHP2Shell to read server memory without authorization. By accessing your server processes, an attacker can potentially obtain further information, such as database passwords, session tokens, environment variables, and API credentials. The problem is therefore far-reaching and puts all of your webspace data at risk.

Applications with built-in PHP

Some applications and IT system components may use their own PHP integration, for example if they provide a PHP-based web interface or API. These integrations can therefore also be vulnerable to PHP2Shell.

For more detailed information, contact the manufacturer of the application or system component. The PHP2Shell alert from the Canadian Centre for Cyber Security (Cyber Centre) can give you further pointers. Among other things, it recommends identifying third-party products, appliances, and containers that include vulnerable PHP components, and links to a list of software products that may be affected. You will find the link to the Cyber Centre alert at the end of this article.

Possible signs of a successful PHP2Shell attack

The Cyber Centre alert recommends reviewing your web server, application, authentication, and endpoint logs for suspicious activity. You should also investigate unexpected processes, commands, files, accounts, or outbound connections associated with PHP or web server services. The resources linked in the alert, such as the official PHP security advisory, provide further technical details.

You will find the link to the Cyber Centre alert at the end of this article.

Steps to take after a successful PHP2Shell attack

If you administer your own server, or if you find concrete evidence of a compromise, such as malicious code or backdoors in your webspace, IONOS recommends restoring your data to a state from before the attacks (early October 2026).

Complete the following steps:

  • Update your PHP packages, and then restart all PHP services.
  • Restore a clean backup of your webspace data.
  • Change all passwords and other access credentials, such as API keys.

If you do not manage your webspace yourself

Forward the link to this article right away to your webmaster, IT department, or the digital agency that supports you. Also include a link to official security information, such as the Cyber Centre alert Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619.

Improving the security of your PHP installation

An important step towards improving the security of your webspace is to use current, officially supported PHP versions. As PHP2Shell demonstrates, even current PHP versions can be vulnerable. However, as a general rule, newer PHP versions are more secure.

If you use IONOS PHP Extended Support, you are generally protected. Nevertheless, for the reason mentioned above, you should consider switching to a current PHP version as soon as possible.

Further information

Content