php2shell
Menu

InMotion Hosting and the PHP2Shell fix

The host says it is installing the fix now.

What InMotion Hosting says

InMotion status incident 'Security Maintenance: PHP Configuration Updates' (from 20 Oct 2026 23:27 GMT-4) names CVE-2026-109618 / CVE-2026-109619. It first disabled the default session.upload_progress.enabled setting as a mitigation. By 21 Oct 21:02 GMT-4 PHP version upgrades had been performed across Shared and Dedicated servers; at 22 Oct 00:42 GMT-4 the VPS upgrades were still in progress, with no completion estimate. CWP and CWP Admin ports were restricted while CWP patches were pending (Support can allow your IP).

The PHP version upgrades for the VPS fleets are still in progress.
status.inmotionhosting.com2026-10-22Official
PHP version upgrades are being committed and have already been performed across Shared and Dedicated servers.
status.inmotionhosting.com2026-10-21Official
we have determined the safest course of action at this time is to restrict ports for CWP/CWP Admin
status.inmotionhosting.com2026-10-21Official
we are disabling the default PHP session.upload_progress.enabled setting
status.inmotionhosting.com2026-10-21Official

What you need to do

Shared, Reseller and WordPress customers: nothing to patch yourself, but move off PHP 7.x/8.0/8.1 to a supported version (8.2+) after testing, and do not re-enable session.upload_progress in .user.ini/php.ini. VPS customers: InMotion is still upgrading PHP on its VPS fleets, so watch the status incident. CWP users: ask Support to allow your IP while the panel ports are restricted. VPS/Dedicated root customers: confirm the updates landed (WHM EasyApache 4 / package manager) and check the PHP actually serving web requests.

Check which PHP your site runs

InMotion Hosting does not document this on the pages we read.

In WordPress, Tools › Site Health › Info › Server shows the PHP version. Paste it into the version check to see whether it is fixed.

Switch to a supported version

cPanel > Software > MultiPHP Manager (select domain, choose version, Apply); server-wide in WHM > MultiPHP Manager.

If you can, choose PHP 8.4. It is fixed, supported until 31 December 2028 and runs almost all current plugins. See which version to choose.

Old PHP versions

InMotion Hosting sells TuxCare PHP Extended Lifecycle Support (add-on) for old PHP versions: $12.00 USD per month per server, cPanel VPS and Dedicated only. Product page Ask whether it covers CVE-2026-109618 and CVE-2026-109619 before relying on it.

Ask InMotion Hosting directly

Copy this into a support ticket and fill in the parts in square brackets.

Hello InMotion Hosting support,

PHP released fixes for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

My account: [account or contract number]
My site: [domain]
PHP version shown in my control panel: [version]

Please confirm:
1. Whether the PHP that serves my site has been updated to one of the fixed releases, or to a build with the fix backported, and the exact version.
2. Whether the PHP processes for my site have been restarted since the update.
3. If not yet, when you expect to finish.
4. If my version is 8.1 or older, which supported version you recommend I switch to.

Thank you.

Pages we read