On October 21, the PHP mission launched fixes for 2 important vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619, now recognized collectively as PHP2Shell. Each are rated 9.2 out of 10 for severity, which could be very excessive. The Elementor Internet hosting workforce took motion instantly and deployed safety for websites earlier than the official repair even grew to become obtainable. Each Elementor Internet hosting web site is now operating a patched and up to date model of PHP. In case your web site is on Elementor Internet hosting, you don’t must do something.
For those who run your Elementor web site some other place, you do. The part under tells you what to test.
What PHP2Shell is
The PHP2Shell flaws are within the PHP runtime, not in WordPress, Elementor, your plugins or theme. They’re associated to how PHP handles requests that get reduce off partway via and what’s stored in reminiscence from that time. As a result of the issue is within the language your code runs on, no quantity of cautious coding in WordPress or Elementor closes it: solely a PHP replace can.
The susceptible code has been in PHP since model 5.Four got here out in 2012, so it applies to numerous servers.
What occurred on our facet
We opened an emergency safety response instantly upon studying of this subject and the upcoming patch. Our internet hosting and safety groups had protections operating at our community edge and on the servers themselves in a brief time period, detecting and blocking the request patterns the exploit will depend on. That gave us respiratory room to use the everlasting repair correctly as an alternative of speeding it.
By way of the remainder of the day, the internet hosting workforce ready up to date PHP builds for each model we assist, together with the automation to push them out throughout our infrastructure. We emailed all Elementor Internet hosting clients that afternoon to inform them what was already in place and what was nonetheless coming, and by the top of the identical day, patched PHP was dwell throughout all supported PHP variations on each Elementor Internet hosting web site.
On account of these actions taken by our workforce, Elementor Internet hosting clients are protected, and there’s nothing that you must do. We handle PHP in your behalf, the patched builds are already operating, and no setting wants altering in your facet.
We’re nonetheless watching carefully for exploit makes an attempt and for any follow-up advisories from the PHP mission.
In case your Elementor web site is hosted some other place
You’ll be able to test for your self whether or not your internet hosting supplier has up to date your PHP model. In your WordPress admin, go to Instruments > Website Well being > Information and open the Server panel, which exhibits the total PHP model all the way down to the patch quantity.
What you wish to see there may be 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or something newer in these branches. Be aware that 8.3.36 is patched, and something decrease within the 8.Three line is just not. In case your quantity falls brief, the replace hasn’t reached your web site but. Many hosts have already patched and emailed their clients, so if yours has been quiet, open a assist ticket and ask the place issues stand.
For those who’re on PHP 8.1 or older, there isn’t a patch coming. These branches stopped receiving safety assist earlier than these flaws have been discovered, and the one actual repair is shifting to a model that’s nonetheless supported. PHP 8.2 is the oldest department that received a repair this time, and its personal safety assist runs out on the finish of this yr, on December 31, 2026. For those who’re planning to improve, goal for 8.Three or newer.
The place an instantaneous PHP replace isn’t attainable, your host can slender the publicity within the meantime with firewall guidelines that block the exploit patterns, tighter limits on file uploads, and turning off PHP’s add progress monitoring. These cut back the chance when you anticipate the replace, however they don’t take away it.
No matter your model quantity says, this can be a good time to find out how your host handles PHP updates typically. Some hosts handle the runtime for you and push safety releases out with out asking. Others depart the model selector in your dashboard and anticipate you to maneuver it your self, which suggests a patch could also be obtainable that’s simply sitting there till you click on to replace. Realizing how your host operates signifies how your updates get dealt with now and what to anticipate the following time one thing like this comes up.
PHP2Shell gained’t be the final PHP safety launch, so when the following one lands, how uncovered your web site is comes down as to whether somebody is making use of these updates for you. On Elementor Internet hosting, that’s us. Wherever else, discover out who it’s so you’re ready.
