We’ll keep this short, since the important part is simple: if your site is hosted with WebHost4Life, you’re already protected against the PHP2Shell vulnerability. Nothing to do on your end.
The 30-second version
Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) made headlines this week. They’re rated 9.2 out of 10 and let an attacker run code on a server remotely — no login needed. Public exploit code is already out there, which is why it blew up so fast.
The PHP team shipped official fixes on October 21st, and we rolled them out to all WebHost4Life servers the same day. Since the official patches only covered PHP 8.2–8.5, we applied community fixes or our own patches for PHP 5.4 through 8.1. Anything older than 5.4 wasn’t affected.
Who’s covered
Everyone on the WebHost4Life control panel — web hosting, semi-dedicated, OpenVZ, KVM, and dedicated servers. Managed Services customers were patched automatically too.
One small ask
You’re safe from this one, but old PHP versions are a standing risk — new bugs pop up all the time and unsupported versions stop getting fixes. Check your PHP version in the WebHost4Life control panel (Advanced -> PHP Settings). If you’re below 8.2, upgrade. Support will do it with you for free.
Which PHP versions still get security updates?
Here is a quick reference guide on which PHP versions are currently supported and will continue to receive both support and security updates, and which PHP versions will no longer receive any updates:
| Release | Released | Active Support | Security Support |
|---|---|---|---|
| 8.5 | 11 months ago (20 Nov 2025) | Ends in 1 year and 2 months (31 Dec 2027) | Ends in 3 years (31 Dec 2029) |
| 8.4 | 1 year and 11 months ago (21 Nov 2024) | Ends in 2 months and 1 week (31 Dec 2026) | Ends in 2 years (31 Dec 2028) |
| 8.3 | 2 years and 11 months ago (23 Nov 2023) | Ended 9 months ago (31 Dec 2025) | Ends in 1 year and 2 months (31 Dec 2027) |
| 8.2 | 3 years and 10 months ago (08 Dec 2022) | Ended 1 year and 9 months ago (31 Dec 2024) | Ends in 2 months and 1 week (31 Dec 2026) |
| 8.1 | 4 years and 11 months ago (25 Nov 2021) | Ended 2 years and 11 months ago (25 Nov 2023) | Ended 9 months ago (31 Dec 2025) |
| 8.0 | 5 years and 11 months ago (26 Nov 2020) | Ended 3 years and 11 months ago (26 Nov 2022) | Ended 2 years and 11 months ago (26 Nov 2023) |
| 7.4 | 6 years and 11 months ago (28 Nov 2019) | Ended 4 years and 11 months ago (28 Nov 2021) | Ended 3 years and 11 months ago (28 Nov 2022) |
| 7.3 | 7 years and 10 months ago (06 Dec 2018) | Ended 5 years and 10 months ago (06 Dec 2020) | Ended 4 years and 10 months ago (06 Dec 2021) |
| 7.2 | 8 years and 11 months ago (30 Nov 2017) | Ended 6 years and 11 months ago (30 Nov 2019) | Ended 5 years and 10 months ago (30 Nov 2020) |
| 7.1 | 9 years ago (01 Dec 2016) | Ended 7 years and 10 months ago (01 Dec 2018) | Ended 6 years and 10 months ago (01 Dec 2019) |
| 7.0 | 10 years ago (03 Dec 2015) | Ended 8 years ago (04 Jan 2018) | Ended 7 years ago (10 Jan 2019) |
| 5.6 | 12 years ago (28 Aug 2014) | Ended 9 years ago (19 Jan 2017) | Ended 7 years ago (31 Dec 2018) |
| 5.5 | 13 years ago (20 Jun 2013) | Ended 11 years ago (10 Jul 2015) | Ended 10 years ago (21 Jul 2016) |
| 5.4 | 14 years ago (01 Mar 2012) | Ended 12 years ago (14 Sep 2014) | Ended 11 years ago (14 Sep 2015) |
| 5.3 | 17 years ago (30 Jun 2009) | Ended 15 years ago (30 Jun 2011) | Ended 12 years ago (14 Aug 2014) |
| 5.2 | 20 years ago (02 Nov 2006) | Ended 18 years ago (02 Nov 2008) | Ended 15 years ago (06 Jan 2011) |
| 5.1 | 20 years ago (24 Nov 2005) | Ended 20 years ago (24 Aug 2006) | Ended 20 years ago (24 Aug 2006) |
| 5.0 | 22 years ago (13 Jul 2004) | Ended 21 years ago (05 Sep 2005) | Ended 21 years ago (05 Sep 2005) |
Only PHP 8.2, 8.3, 8.4, and 8.5 currently receive official security updates; PHP 8.2 reaches end-of-life on December 31, 2026.
The affected older PHP versions have been patched for the recent vulnerabilities, but they remain unsupported and may contain other security issues.
We strongly recommend upgrading to a newer, supported PHP version to lower your security risk and keep your site protected.
Questions? Ticket us — happy to help.