Hosting blog

On October 21, 2026, two extremely serious security vulnerabilities were disclosed in the PHP programming language, identified as CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, collectively known as PHP2Shell, may allow attackers to execute malicious code remotely on web servers without authentication.

These vulnerabilities pose a significant threat to websites running content management systems such as Joomla, Wordpress, Drupal, PrestaShop, and other PHP-based applications.

MyDreams innovations s.r.o. has already provided security patches for PHP 7.4 and PHP 8, helping protect websites and applications that still depend on older PHP versions.

Nevertheless, we strongly recommend upgrading websites to modern PHP versions, ideally PHP 8.5, or at least PHP 8.2 as a temporary migration step.

What Is PHP2Shell and Why Is It So Dangerous?

PHP2Shell refers to two serious security vulnerabilities affecting PHP's internal mechanisms responsible for processing HTTP requests and managing system memory.

The first vulnerability, CVE-2026-109618, involves incorrect handling of out-of-memory conditions. Under specific circumstances, this can cause memory corruption and potentially allow an attacker to execute arbitrary code.

The second vulnerability, CVE-2026-109619, is related to improper memory management between HTTP requests. PHP may access memory that has already been released, creating a use-after-free condition that attackers may exploit.

Successful exploitation could result in:

• Remote execution of malicious code.
• Unauthorized access to website files.
• Theft of database credentials and sensitive information.
• Unauthorized modifications to websites and applications.
• Installation of web shells and other malicious software.
• Compromise of additional applications running under the same system account.

The actual impact depends on the server configuration, PHP process permissions, and isolation between individual websites.

Which PHP Versions Are Vulnerable?

On October 21, 2026, the PHP development team released security updates addressing these vulnerabilities in supported PHP branches.

Older PHP versions that have reached their official end of life may no longer receive standard security updates from the PHP development team.

Some hosting providers and long-term support vendors may supply additional security patches for these legacy PHP versions.

This makes proactive security maintenance by your hosting provider especially important.

MyDreams Has Already Provided Security Patches for PHP 7.4 and PHP 8

MyDreams innovations s.r.o. responded to the disclosure of the critical PHP2Shell vulnerabilities and has already provided customers with security patches for PHP 7.4 and PHP 8.

We pay particular attention to older web applications that require legacy PHP versions and cannot immediately migrate to the latest PHP release.

Providing security patches for older PHP environments helps our customers continue operating their applications with an improved level of protection.

However, patching legacy PHP versions should not be considered a permanent solution. Outdated content management systems, unsupported extensions, and old website templates may contain additional security vulnerabilities that PHP updates alone cannot resolve.

We Recommend Upgrading to PHP 8.2 or, Ideally, PHP 8.5

We strongly encourage all website owners to plan a migration to a modern, officially supported PHP version.

For older applications, PHP 8.2 may serve as an initial migration step. However, official security support for PHP 8.2 ends on December 31, 2026.

For long-term website operation, we recommend PHP 8.5, which receives official security support until the end of 2029.

If your application does not yet support PHP 8.5, we recommend using the latest compatible and officially supported PHP version, such as PHP 8.4.

Modern PHP versions offer several advantages:

• Improved security and regular security updates.
• Better website and application performance.
• Modern features and runtime optimizations.
• Better compatibility with current content management systems.
• Improved long-term stability and maintainability.

Which Joomla, Wordpress, and PrestaShop Versions Support PHP 8.2?

Not every CMS version supports modern PHP environments. Before upgrading PHP, it is essential to verify the compatibility of the CMS core, website template, plugins, modules, and extensions.

Joomla – PHP 8.2 Compatibility

Joomla 3 is outdated, and we strongly discourage its continued use.

Official support for Joomla 3 ended in 2023, followed by the end of extended support in 2025. Nevertheless, many websites are still operating on this legacy CMS generation.

The main problem is not limited to Joomla's compatibility with newer PHP versions. Older templates, components, modules, and plugins often represent an even greater obstacle.

Many legacy Joomla extensions are no longer maintained and are incompatible with modern Joomla or PHP releases.

For websites built on Joomla 3, we generally recommend creating a completely new website using the latest Joomla version.

In practice, upgrading an old Joomla website can be more complicated than building a replacement. Website owners may face incompatible extensions, obsolete templates, database changes, and numerous technical issues.

For standard business and presentation websites, creating a new website and transferring the existing content is often easier, faster, and more affordable than attempting to repair an outdated system.

A website rebuild also provides an opportunity to modernize the design, improve loading speeds, strengthen SEO, and eliminate years of accumulated technical problems.

For larger websites with complex custom functionality, a carefully planned migration may still be preferable. Each project should therefore be evaluated individually.

PrestaShop – PHP 8.2 Compatibility

For modern e-commerce websites, we recommend PrestaShop 9.1 with PHP 8.5.

Upgrading older PrestaShop 1.6 and 1.7 installations can be extremely complicated.

Common challenges include incompatible modules, outdated themes, custom modifications, and differences in database structures.

In many cases, we recommend creating a new online store and migrating products, categories, customers, and orders.

This approach can be safer and more cost-effective than attempting to reconstruct an outdated e-commerce platform.

During migration, it is important to preserve essential customer and order information, maintain important URLs, and configure appropriate redirects to avoid unnecessary losses in search engine rankings.

WordPress – PHP 8.2 Compatibility

Compared with some other content management systems, WordPress generally provides relatively good backward compatibility.

Most older WordPress installations can be upgraded without rebuilding the entire website.

However, problems may occur with outdated themes, abandoned plugins, or custom PHP code.

We recommend updating the WordPress core and extensions first, checking compatibility with modern PHP versions, and then upgrading to PHP 8.2, 8.4, or 8.5, depending on application requirements.

If a website relies heavily on obsolete themes or incompatible plugins, rebuilding it using modern technologies may be the better long-term solution.

Old Websites: When Should You Upgrade and When Should You Build a New Website?

Owners of older websites frequently face an important decision: should they invest in a major upgrade of their existing platform, or create an entirely new website?

Migrating legacy websites can introduce significant compatibility problems involving PHP, databases, templates, components, plugins, and other extensions.

Some websites were developed more than ten years ago and rely on technologies that are no longer actively maintained.

In these situations, upgrading may become unnecessarily expensive and time-consuming.

Creating a new website is often easier, faster, and less expensive than extensively rebuilding an outdated platform.

A new website also offers the opportunity to:

• Use a modern and secure content management system.
• Move to PHP 8.5 where supported.
• Improve website performance and usability.
• Create a modern, mobile-friendly design.
• Improve technical SEO and search engine indexing.
• Optimize loading performance and Core Web Vitals.
• Remove outdated and unnecessary extensions.
• Prepare the website for future updates and development.

When rebuilding a website, valuable content and important URLs should be preserved whenever possible. If URL structures change, appropriate HTTP 301 redirects should be implemented.

Our recommendation: Do not continue operating an outdated website simply because it still works.

A functioning website is not necessarily a secure website.

Can ModSecurity or Cloudflare WAF Help?

In addition to PHP security updates, Web Application Firewall (WAF) technologies can provide another important layer of protection.

Solutions such as ModSecurity and Cloudflare WAF can inspect incoming HTTP requests before they reach the PHP application.

These technologies may identify and block certain suspicious requests, including specially crafted multipart/form-data requests associated with exploitation attempts.

Cloudflare has also announced protective measures against attempts to exploit PHP2Shell vulnerabilities.

However, a Web Application Firewall is not a substitute for patching PHP. Installing a properly patched PHP version remains the most effective protection.

Temporary Security Mitigations

If PHP cannot be updated immediately, several temporary measures may help reduce the risk of exploitation.

One recommended measure is disabling PHP session upload progress tracking:

session.upload_progress.enabled = Off

For PHP 8.5, detailed fatal error backtraces may also be temporarily disabled:

fatal_error_backtraces = Off

Additional measures include limiting incoming HTTP request sizes, properly configuring PHP-FPM, and implementing security rules at the web server level.

These mitigations only reduce risk. They must not be considered a replacement for installing the necessary PHP security patches.

What Should Website Owners Do?

We recommend first checking which PHP version and content management system version your website currently uses.

Then take the following steps:

• Update PHP to a patched and officially supported version.
• For older applications, consider PHP 8.2 as a temporary migration step before moving to a newer supported version.
• For modern applications, prefer PHP 8.5 wherever compatibility allows.
• Update Joomla, WordPress, or PrestaShop to their latest stable releases.
• Verify compatibility of all templates, modules, plugins, and extensions.
• Consider a complete website rebuild if your CMS is outdated or difficult to maintain.
• Maintain regular backups of website files and databases.
• Monitor security advisories and apply updates promptly.

Customer Security Is a Priority at MyDreams

MyDreams innovations s.r.o. has been providing professional web hosting, VPS servers, dedicated servers, and Linux server administration services since 2004.

Server infrastructure security and customer data protection are among the key priorities of our services.

We continuously monitor emerging security threats, evaluate their impact, and implement appropriate protective measures.

In response to the critical PHP2Shell vulnerabilities, we have already provided security patches for PHP 7.4 and PHP 8, helping protect customers who still depend on older web applications.

At the same time, we encourage customers to gradually move away from obsolete technologies and adopt modern PHP versions and actively maintained content management systems.

Need to Upgrade an Old Website or Build a New One?

Are you running a website based on Joomla 3, an older PrestaShop version, or an outdated WordPress installation?

Does your website fail to work with modern PHP? Are you using extensions that are no longer maintained or compatible with current technologies?

Our team can help evaluate your website's technical condition and recommend an appropriate upgrade or replacement strategy.

In many cases, building a new website on a modern platform can be faster and more cost-effective than extensively repairing an outdated system.

MyDreams – Professional Web Hosting, VPS Servers, and Server Administration Since 2004.

www.mydreams.cz

Sources and Further Information

• PHP.net – Official PHP Security Updates
• PHP.net – Supported PHP Versions
• Joomla – Technical Requirements
• PrestaShop 9 – System Requirements
• WordPress – PHP Compatibility
• Root.cz – Serious PHP Vulnerabilities Allow Remote Code Execution