Published: 21 October 2026, 15:30 BST.
Giraffe Hosting Limited, the owner of Giraffe Digital, has patched its managed hosting servers against PHP2Shell, the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. We acted as soon as PHP released the fixes, checked all client websites as part of the response and extended the remediation across the PHP versions available on our servers, including legacy PHP 5 installations through backported security fixes.
For clients, the important outcome is that the response covered the PHP environment running their website, including sites that still depend on an older runtime. Our work addressed these two vulnerabilities across the managed platform rather than relying solely on customers updating their website applications.
A rapid response to the PHP2Shell security release
The PHP project issued emergency security releases after warning about two critical remote code execution vulnerabilities. CERT-EU records the fixes as released at 13:30 UTC on 21 October 2026, or 14:30 BST. We completed the server patching and client website checks by 15:30 BST on 21 October 2026, one hour after that recorded release time.
The fixed upstream releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The PHP team's release announcement explains the urgency of installing a release containing the corrections.
Our response covered three priorities:
- Patch the servers: apply the PHP2Shell security fixes across our managed hosting environment as they became available.
- Cover legacy runtimes: apply backported corrections to the older PHP versions offered on the platform, including PHP 5.
- Check client websites: check all client websites following the server updates.
Why older PHP versions needed attention too
A hosting security response needs to account for the PHP versions that websites actually use. Some established sites still depend on older applications, extensions or integrations. Leaving an older runtime out of an emergency update would leave those customers outside the response.
We therefore included legacy PHP installations in our patching work. A backported PHP security fix applies the relevant correction to an older branch while retaining that branch's compatibility characteristics. This allows an existing application to receive the specific fix without an immediate move to a different major PHP version.
These are hosting-platform backports. PHP 5 remains end-of-life in the upstream PHP project. The official PHP security advisory explains the role of distributions and extended-support suppliers in providing fixes for older branches.
A backport for PHP2Shell does not make an old application current in every other respect. We encourage clients with legacy PHP requirements to plan an upgrade with compatibility testing, so future maintenance is easier to manage.
Client website checks were part of the response
We checked all client websites following the PHP updates. Applying a server fix and checking the websites that depend on that server belong together: customers need their hosting maintained and their business website available for everyday use.
If a client notices an unexpected issue with a form, account area, checkout or other website feature, they should contact Giraffe Digital with the affected page and a short description. This gives us a clear starting point for checking the specific problem.
What Giraffe Digital clients need to do
Clients covered by our managed hosting response do not need to apply the server-side PHP2Shell patch themselves. We have handled that part of the work through Giraffe Hosting.
Continue to keep website applications, plugins and themes maintained. If your business uses an additional website, staging environment or application with another provider, obtain a separate patch confirmation for that environment. Our hosting update describes the systems we manage.
For the background, affected PHP versions and a practical website-owner checklist, read PHP2Shell: CVE-2026-109618 and CVE-2026-109619 Explained.
Giraffe Hosting PHP2Shell FAQs
Clients with a website on another hosting platform should check its patch status directly with that provider.
Have Giraffe Digital's hosted client websites been covered?
Yes. Giraffe Hosting Limited, the owner of Giraffe Digital, patched its managed hosting servers for CVE-2026-109618 and CVE-2026-109619 and checked all client websites as part of the response.
Did the PHP2Shell patching include PHP 5?
Yes. Our response included legacy PHP 5 installations through backported fixes on our hosting platform. This is platform-specific security maintenance; clients using PHP 5 elsewhere should obtain confirmation from their own provider.
Do I need to change WordPress or install a PHP2Shell plugin?
Clients covered by our managed hosting response do not need a plugin to apply the server-side PHP fix. Continue normal WordPress, plugin and theme maintenance, because those components have their own update requirements.
Why might my PHP version number still look old after patching?
A backported fix can retain the original PHP branch number while changing the package or build revision. Protection therefore depends on the installed security corrections, not simply on whether the displayed number begins with PHP 5, PHP 7 or PHP 8. Contact us if you need clarification about your hosted website.
Does this update replace ongoing website security maintenance?
These updates address the two PHP2Shell vulnerabilities. Application updates, access management, backups and monitoring remain important parts of maintaining a website. Clients relying on an older PHP branch should also plan a supported-version upgrade with appropriate testing.
