To protect your Hostinger VPS from the php2shell PHP vulnerabilities, update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restart PHP. If you can’t update straight away, disable session upload progress as a temporary measure and limit file uploads. You manage PHP yourself on a Hostinger VPS, so Hostinger’s server-level protections don’t apply to it. Websites on Hostinger Web, Cloud, Agency, and cPanel hosting are already protected and need no action.<\/p>
The php2shell PHP vulnerabilities are two critical flaws, CVE-2026-109618 and CVE-2026-109619, that the PHP project fixed on October 21, 2026. Both are rated 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS). Details leaked before the planned release, and exploit code for one of the flaws circulated before the fix was available.<\/p>
Every PHP version before 8.5.12, 8.4.27, 8.3.36, and 8.2.35 is affected, including WordPress, WooCommerce, and Magento websites. Updating WordPress, themes, or plugins doesn’t fix php2shell, because the flaws are in PHP itself.<\/p>
You don’t need to do anything if your Hostinger VPS<\/a> doesn’t run PHP.<\/p> Update PHP on your Hostinger VPS to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as soon as you can, then restart PHP. Updating PHP is the only complete fix for php2shell.<\/p> PHP 8.1 and older versions no longer get fixes from the PHP project. Upgrade PHP on your VPS to a patched version of PHP 8.2 or newer.<\/p>\n<\/div> PHP 8.2 stops getting security fixes on December 31, 2026, so choose PHP 8.3 or newer when possible.<\/p> Disable NOTE<\/b><\/p> Turn off file uploads you don’t need and keep upload size limits reasonable. These changes lower your php2shell risk, but they don’t replace the PHP update. For more ways to protect your server, see How to secure your VPS from abusive activity at Hostinger<\/a>.<\/p> Once you install a patched PHP version and restart PHP, your Hostinger VPS is protected from both php2shell vulnerabilities.<\/p> Additional resources<\/strong><\/p> Update PHP on your Hostinger VPS to patch CVE-2026-109618 and CVE-2026-109619<\/p>\n","protected":false},"author":595,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"include_on_kodee":true,"footnotes":""},"categories":[199],"tags":[],"class_list":["post-21357","post","type-post","status-publish","format-standard","hentry","category-vps-management"],"hreflangs":[],"include_on_kodee":true,"_links":{"self":[{"href":"https:\/\/www.hostinger.com\/support\/wp-json\/wp\/v2\/posts\/21357","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hostinger.com\/support\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hostinger.com\/support\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hostinger.com\/support\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hostinger.com\/support\/wp-json\/wp\/v2\/comments?post=21357"}],"version-history":[{"count":12,"href":"https:\/\/www.hostinger.com\/support\/wp-json\/wp\/v2\/posts\/21357\/revisions"}],"predecessor-version":[{"id":21618,"href":"https:\/\/www.hostinger.com\/support\/wp-json\/wp\/v2\/posts\/21357\/revisions\/21618"}],"wp:attachment":[{"href":"https:\/\/www.hostinger.com\/support\/wp-json\/wp\/v2\/media?parent=21357"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hostinger.com\/support\/wp-json\/wp\/v2\/categories?post=21357"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hostinger.com\/support\/wp-json\/wp\/v2\/tags?post=21357"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Update PHP on your Hostinger VPS to fix php2shell<\/h2>
Disable session upload progress on your Hostinger VPS if you can’t update PHP yet<\/h2>
session.upload_progress<\/code> as a temporary measure if you can’t update PHP on your Hostinger VPS straight away. This setting blocks only CVE-2026-109619, so update PHP as soon as possible.<\/p>\n
session.upload_progress.enabled = Off<\/code> in php.ini<\/code> or in your PHP-FPM pool config.<\/li>\n\n
session.upload_progress.enabled<\/code> in your code with ini_set<\/code> doesn’t work.<\/li>\n<\/ul>\n
Reduce upload risk on your Hostinger VPS<\/h2>
\n