php2shell
Menu

IONOS and the PHP2Shell fix

The host says it is installing the fix now.

What IONOS says

IONOS status page (ionos-status.de), 21 Oct 2026: incident 'Sicherheitswartung: Kurze Unterbrechungen bei PHP-basierten Diensten moeglich' says a critical security vulnerability was found and IONOS is currently installing the security update on all its systems, expecting to finish within 24 hours. A separate incident says Nextcloud instances were disabled as a precaution due to a critical PHP vulnerability until an official patch is available. The status entries do not name the CVE IDs. Secondary reports quoting a customer notice say webhosting packages and managed servers were temporarily taken offline; that part is unverified; the status page does not mention it.

installieren wir das Sicherheitsupdate derzeit auf allen unseren Systemen
ionos-status.de2026-10-21Official
Wir gehen davon aus, dass wir innerhalb der nächsten 24 Stunden fertig sein werden.
ionos-status.de2026-10-21Official
Aufgrund einer kritischen PHP-Sicherheitslücke wurden Nextcloud-Instanzen als Vorsichtsmaßnahme
ionos-status.de2026-10-21Official

What you need to do

Shared Linux Web Hosting and Managed Hosting: IONOS is rolling out the fix itself; check status page for completion. Pick a currently supported PHP version (8.2+ / 8.4 recommended by IONOS) rather than PHP 8.1 or older. Managed Hosting for WordPress and MyWebsite: version is controlled by IONOS. Root server / VPS / Managed Dedicated customers should update PHP themselves or via their OS/Plesk packages.

Check which PHP your site runs

IONOS account > Menu > Hosting > select contract > PHP tile > Manage (lists each domain with its assigned PHP version)

In WordPress, Tools › Site Health › Info › Server shows the PHP version. Paste it into the version check to see whether it is fixed.

Switch to a supported version

Same page: click a domain (or tick several and click 'Select PHP version'), choose version, Save. Not possible on Managed Hosting for WordPress / MyWebsite.

If you can, choose PHP 8.4. It is fixed, supported until 31 December 2028 and runs almost all current plugins. See which version to choose.

Old PHP versions

IONOS sells PHP Extended Support for old PHP versions: Per ionos.com product page (USD): PHP 7.4/8.0 $15.62/month, PHP 8.1 $7.81/month, PHP 7.0-7.3 $18.28/month, PHP 5.x $23.58/month, PHP 4 $27.36/month; EUR pricing on ionos.de not checked. Product page Ask whether it covers CVE-2026-109618 and CVE-2026-109619 before relying on it.

Ask IONOS directly

Copy this into a support ticket and fill in the parts in square brackets.

Hello IONOS support,

PHP released fixes for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

My account: [account or contract number]
My site: [domain]
PHP version shown in my control panel: [version]

Please confirm:
1. Whether the PHP that serves my site has been updated to one of the fixed releases, or to a build with the fix backported, and the exact version.
2. Whether the PHP processes for my site have been restarted since the update.
3. If not yet, when you expect to finish.
4. If my version is 8.1 or older, which supported version you recommend I switch to.

Thank you.

Pages we read