Two critical PHP vulnerabilities dominated security news this week. Here’s the good news for TightHost customers: the fixes are already live on your servers, and there’s nothing you need to do.
What happened
Researchers disclosed two runtime-level PHP vulnerabilities — CVE-2026-109618 and CVE-2026-109619, together known as “PHP2Shell.” Both are rated 9.2 (Critical) under CVSS v4.0 and permit unauthenticated remote code execution. Public proof-of-concept exploits are already in circulation, which is why the story spread so quickly.
Because these flaws exist in the PHP runtime itself, updating your CMS, theme, or plugins won’t protect you — the fix has to be applied at the PHP level.
How TightHost responded
The PHP development team published official patches on October 21st, and we deployed them across all TightHost infrastructure the same day.
The official releases covered only PHP 8.2 through 8.5. For every other affected branch — PHP 5.4 through 8.1 — we applied community backports or our own custom patches. Versions below PHP 5.4 were not exposed to this disclosure.
Coverage
- All TightHost hosting — shared hosting, semi-dedicated, OpenVZ, KVM, and dedicated servers
- All Reseller Program nodes
- All Managed Services deployments
No action is required from customers to receive these patches.
One thing worth checking
You’re protected from PHP2Shell, but running an unsupported PHP branch remains a standing risk. New flaws surface regularly, and end-of-life versions no longer receive official fixes — which makes them attractive targets. We recommend confirming your PHP version in the TightHost control panel (Advanced -> PHP Settings) and upgrading if you’re below 8.2. Our support team will assist at no additional cost.
PHP version support reference
Here is a quick reference guide on which PHP versions are currently supported and will continue to receive both support and security updates, and which PHP versions will no longer receive any updates:
| Release | Released | Active Support | Security Support |
|---|---|---|---|
| 8.5 | 11 months ago (20 Nov 2025) | Ends in 1 year and 2 months (31 Dec 2027) | Ends in 3 years (31 Dec 2029) |
| 8.4 | 1 year and 11 months ago (21 Nov 2024) | Ends in 2 months and 1 week (31 Dec 2026) | Ends in 2 years (31 Dec 2028) |
| 8.3 | 2 years and 11 months ago (23 Nov 2023) | Ended 9 months ago (31 Dec 2025) | Ends in 1 year and 2 months (31 Dec 2027) |
| 8.2 | 3 years and 10 months ago (08 Dec 2022) | Ended 1 year and 9 months ago (31 Dec 2024) | Ends in 2 months and 1 week (31 Dec 2026) |
| 8.1 | 4 years and 11 months ago (25 Nov 2021) | Ended 2 years and 11 months ago (25 Nov 2023) | Ended 9 months ago (31 Dec 2025) |
| 8.0 | 5 years and 11 months ago (26 Nov 2020) | Ended 3 years and 11 months ago (26 Nov 2022) | Ended 2 years and 11 months ago (26 Nov 2023) |
| 7.4 | 6 years and 11 months ago (28 Nov 2019) | Ended 4 years and 11 months ago (28 Nov 2021) | Ended 3 years and 11 months ago (28 Nov 2022) |
| 7.3 | 7 years and 10 months ago (06 Dec 2018) | Ended 5 years and 10 months ago (06 Dec 2020) | Ended 4 years and 10 months ago (06 Dec 2021) |
| 7.2 | 8 years and 11 months ago (30 Nov 2017) | Ended 6 years and 11 months ago (30 Nov 2019) | Ended 5 years and 10 months ago (30 Nov 2020) |
| 7.1 | 9 years ago (01 Dec 2016) | Ended 7 years and 10 months ago (01 Dec 2018) | Ended 6 years and 10 months ago (01 Dec 2019) |
| 7.0 | 10 years ago (03 Dec 2015) | Ended 8 years ago (04 Jan 2018) | Ended 7 years ago (10 Jan 2019) |
| 5.6 | 12 years ago (28 Aug 2014) | Ended 9 years ago (19 Jan 2017) | Ended 7 years ago (31 Dec 2018) |
| 5.5 | 13 years ago (20 Jun 2013) | Ended 11 years ago (10 Jul 2015) | Ended 10 years ago (21 Jul 2016) |
| 5.4 | 14 years ago (01 Mar 2012) | Ended 12 years ago (14 Sep 2014) | Ended 11 years ago (14 Sep 2015) |
| 5.3 | 17 years ago (30 Jun 2009) | Ended 15 years ago (30 Jun 2011) | Ended 12 years ago (14 Aug 2014) |
| 5.2 | 20 years ago (02 Nov 2006) | Ended 18 years ago (02 Nov 2008) | Ended 15 years ago (06 Jan 2011) |
| 5.1 | 20 years ago (24 Nov 2005) | Ended 20 years ago (24 Aug 2006) | Ended 20 years ago (24 Aug 2006) |
| 5.0 | 22 years ago (13 Jul 2004) | Ended 21 years ago (05 Sep 2005) | Ended 21 years ago (05 Sep 2005) |
At present, only PHP 8.2, 8.3, 8.4, and 8.5 receive official security updates, and PHP 8.2 reaches end-of-life on December 31, 2026.
Older branches were patched for these specific vulnerabilities, but they remain unsupported and may contain other unresolved issues.
We strongly recommend upgrading to a supported PHP version to minimize risk and keep your site protected.
Questions about your account’s patch status? Open a ticket and our team will help.