php2shell
Menu

Nexcess (Liquid Web) and the PHP2Shell fix

The host has not yet said whether it is affected or what it will do.

What Nexcess (Liquid Web) says

Nexcess status incident 'PHP Security Vulnerability Assessment (CVE-2026-109618 & CVE-2026-109619)' (investigating, 2026-10-21 12:06 EDT) says teams are evaluating a patching strategy and testing in staging, with no production patches yet; mitigations are being applied and fixes will be deployed as available. Maintenance windows not yet announced. The incident was still open at our last check.

no patches or modifications have been rolled out to production systems
status.nexcess.net2026-10-21Official
may affect web servers running PHP 5.4 and later and could potentially allow remote code execution
status.nexcess.net2026-10-21Official

What you need to do

Watch the Nexcess status incident for the rollout plan and maintenance windows; contact Support with concerns. After rollout, confirm the PHP version serving the site and move off EOL PHP versions (PHP 8.1 and older got no official release).

Check which PHP your site runs

Client Portal > Sites > click domain > left menu 'Show More' > Management > PHP (shows current version). Magento/Drupal: plan-level Management.

In WordPress, Tools › Site Health › Info › Server shows the PHP version. Paste it into the version check to see whether it is fixed.

Switch to a supported version

Client Portal > Sites > domain > Management > PHP > 'Change PHP version' > pick version > Update. SiteWorx (physical servers): PHP Version > Update PHP Version dropdown > Select.

If you can, choose PHP 8.4. It is fixed, supported until 31 December 2028 and runs almost all current plugins. See which version to choose.

Old PHP versions

We found no paid support for old PHP versions at Nexcess (Liquid Web).

Ask Nexcess (Liquid Web) directly

Copy this into a support ticket and fill in the parts in square brackets.

Hello Nexcess (Liquid Web) support,

PHP released fixes for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

My account: [account or contract number]
My site: [domain]
PHP version shown in my control panel: [version]

Please confirm:
1. Whether the PHP that serves my site has been updated to one of the fixed releases, or to a build with the fix backported, and the exact version.
2. Whether the PHP processes for my site have been restarted since the update.
3. If not yet, when you expect to finish.
4. If my version is 8.1 or older, which supported version you recommend I switch to.

Thank you.

Pages we read