php2shell
Menu

Cloudways and the PHP2Shell fix

The host says it is installing the fix now.

What Cloudways says

Cloudways status incident (21–22 Oct 2026): interim configuration-level mitigations recommended by the PHP Group went out across the fleet, then official patches rolled out in phases for all Cloudways-supported PHP versions, PHP 5.6, 7.4 and 8.0–8.4 (deprecated versions through its ELTS partners). Applications on Autonomous were patched by 01:02 UTC on 22 Oct. At 07:03 UTC the rollout on Flexible was in its final stage, with all patching expected to finish by 09:00 UTC. No customer action needed. The page does not name PHP2Shell or the CVE numbers.

The PHP security patch rollout is in its final stage, with the majority of servers now patched.
status.cloudways.com2026-10-22Official
We have applied security patches for all customer applications hosted on Autonomous.
status.cloudways.com2026-10-22Official
The rollout is currently in progress and includes PHP 5.6, 7.4, 8.0, 8.1, 8.2, 8.3, and 8.4
status.cloudways.com2026-10-21Official
Interim protections remain in place until then and no action is needed from the customers.
status.cloudways.com2026-10-22Official

What you need to do

None needed per Cloudways. Once the rollout is finished, confirm the PHP version in the platform; applications on deprecated PHP versions should still move to a supported version.

Check which PHP your site runs

Cloudways does not document this on the pages we read.

In WordPress, Tools › Site Health › Info › Server shows the PHP version. Paste it into the version check to see whether it is fixed.

Switch to a supported version

Not documented on the pages we read.

If you can, choose PHP 8.4. It is fixed, supported until 31 December 2028 and runs almost all current plugins. See which version to choose.

Old PHP versions

We found no paid support for old PHP versions at Cloudways.

Ask Cloudways directly

Copy this into a support ticket and fill in the parts in square brackets.

Hello Cloudways support,

PHP released fixes for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

My account: [account or contract number]
My site: [domain]
PHP version shown in my control panel: [version]

Please confirm:
1. Whether the PHP that serves my site has been updated to one of the fixed releases, or to a build with the fix backported, and the exact version.
2. Whether the PHP processes for my site have been restarted since the update.
3. If not yet, when you expect to finish.
4. If my version is 8.1 or older, which supported version you recommend I switch to.

Thank you.

Pages we read