Search in all categories
Search in all categories
About Hostinger
Affiliates and Referrals
Agency Hosting Plans
AI Automation Apps
API
Billing
Blog
Codex
cPanel
Design
DNS
Domains
Email
Features
Files Management
General
Getting Started
Google Ads
Hostinger Agent
Hostinger AI Builder
Hostinger AI Router
Hostinger dashboard
Hostinger Ecommerce
Hostinger Reach
Integrations
MySQL Databases
Online Store
Pages and Navigation
Partner Program
PHP
Profile Management
SEO
SSL Certificates
VPS
Website
Website Elements
Website Sections

How to protect your VPS from the php2shell PHP vulnerabilities at Hostinger

Update PHP on your Hostinger VPS to patch CVE-2026-109618 and CVE-2026-109619

Updated 4 days ago

To protect your Hostinger VPS from the php2shell PHP vulnerabilities, update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restart PHP. If you can’t update straight away, disable session upload progress as a temporary measure and limit file uploads. You manage PHP yourself on a Hostinger VPS, so Hostinger’s server-level protections don’t apply to it. Websites on Hostinger Web, Cloud, Agency, and cPanel hosting are already protected and need no action.

What the php2shell PHP vulnerabilities are

The php2shell PHP vulnerabilities are two critical flaws, CVE-2026-109618 and CVE-2026-109619, that the PHP project fixed on October 21, 2026. Both are rated 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS). Details leaked before the planned release, and exploit code for one of the flaws circulated before the fix was available.

Every PHP version before 8.5.12, 8.4.27, 8.3.36, and 8.2.35 is affected, including WordPress, WooCommerce, and Magento websites. Updating WordPress, themes, or plugins doesn’t fix php2shell, because the flaws are in PHP itself.

You don’t need to do anything if your Hostinger VPS doesn’t run PHP.

Update PHP on your Hostinger VPS to fix php2shell

Update PHP on your Hostinger VPS to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as soon as you can, then restart PHP. Updating PHP is the only complete fix for php2shell.

PHP 8.1 and older versions no longer get fixes from the PHP project. Upgrade PHP on your VPS to a patched version of PHP 8.2 or newer.

PHP 8.2 stops getting security fixes on December 31, 2026, so choose PHP 8.3 or newer when possible.

Disable session upload progress on your Hostinger VPS if you can’t update PHP yet

Disable session.upload_progress as a temporary measure if you can’t update PHP on your Hostinger VPS straight away. This setting blocks only CVE-2026-109619, so update PHP as soon as possible.

  1. Set session.upload_progress.enabled = Off in php.ini or in your PHP-FPM pool config.
  2. Restart all PHP workers.

NOTE

  • Setting session.upload_progress.enabled in your code with ini_set doesn’t work.
This closes one of the two php2shell bugs and fully protects against CVE-2026-115560, announced on October 23. When PHP ships the fix for the latter, update as part of your normal maintenance.
NOTE:
  • Turn off uploads you don’t need and keep upload size limits reasonable. It lowers your risk, but it isn’t a substitute for updating

Reduce upload risk on your Hostinger VPS

Turn off file uploads you don’t need and keep upload size limits reasonable. These changes lower your php2shell risk, but they don’t replace the PHP update. For more ways to protect your server, see How to secure your VPS from abusive activity at Hostinger.

Once you install a patched PHP version and restart PHP, your Hostinger VPS is protected from both php2shell vulnerabilities.

Additional resources