Two critical PHP runtime vulnerabilities made global headlines this week, and we want KamHost customers to know exactly where things stand: the fixes are already in place on your servers.
What was discovered
Security researchers identified two flaws in the PHP runtime — CVE-2026-109618 and CVE-2026-109619 — collectively known as “PHP2Shell.” Both are rated 9.2 (Critical) under CVSS v4.0 and allow an attacker to execute arbitrary code remotely without authentication. Working proof-of-concept exploits are already public.
Because these are runtime-level vulnerabilities, patching your CMS, theme, or plugins will not protect you. The fix has to happen at the PHP level.
How KamHost responded
The PHP project published official patches on October 21st, and we deployed them to all KamHost servers immediately. Since the official releases covered only PHP 8.2 through 8.5, our team also applied community backports or custom patches for every other affected branch — PHP 5.4 through 8.1. Versions prior to 5.4 were not vulnerable to this disclosure.
Coverage summary
- All KamHost hosting — shared, semi-dedicated, OpenVZ, KVM, and dedicated servers
- All Managed Services deployments
No action is required from customers to receive these patches.
A recommendation worth acting on
While you are protected from PHP2Shell, running an unsupported PHP branch remains a standing risk. New vulnerabilities surface regularly, and end-of-life versions no longer receive official fixes — making them attractive targets. We encourage you to confirm your PHP version in the KamHost control panel (Advanced -> PHP Settings) and upgrade if you are below 8.2. Our support team can assist at no additional charge.
PHP version support reference
Here is a quick reference guide on which PHP versions are currently supported and will continue to receive both support and security updates, and which PHP versions will no longer receive any updates:
| Release | Released | Active Support | Security Support |
|---|---|---|---|
| 8.5 | 11 months ago (20 Nov 2025) | Ends in 1 year and 2 months (31 Dec 2027) | Ends in 3 years (31 Dec 2029) |
| 8.4 | 1 year and 11 months ago (21 Nov 2024) | Ends in 2 months and 1 week (31 Dec 2026) | Ends in 2 years (31 Dec 2028) |
| 8.3 | 2 years and 11 months ago (23 Nov 2023) | Ended 9 months ago (31 Dec 2025) | Ends in 1 year and 2 months (31 Dec 2027) |
| 8.2 | 3 years and 10 months ago (08 Dec 2022) | Ended 1 year and 9 months ago (31 Dec 2024) | Ends in 2 months and 1 week (31 Dec 2026) |
| 8.1 | 4 years and 11 months ago (25 Nov 2021) | Ended 2 years and 11 months ago (25 Nov 2023) | Ended 9 months ago (31 Dec 2025) |
| 8.0 | 5 years and 11 months ago (26 Nov 2020) | Ended 3 years and 11 months ago (26 Nov 2022) | Ended 2 years and 11 months ago (26 Nov 2023) |
| 7.4 | 6 years and 11 months ago (28 Nov 2019) | Ended 4 years and 11 months ago (28 Nov 2021) | Ended 3 years and 11 months ago (28 Nov 2022) |
| 7.3 | 7 years and 10 months ago (06 Dec 2018) | Ended 5 years and 10 months ago (06 Dec 2020) | Ended 4 years and 10 months ago (06 Dec 2021) |
| 7.2 | 8 years and 11 months ago (30 Nov 2017) | Ended 6 years and 11 months ago (30 Nov 2019) | Ended 5 years and 10 months ago (30 Nov 2020) |
| 7.1 | 9 years ago (01 Dec 2016) | Ended 7 years and 10 months ago (01 Dec 2018) | Ended 6 years and 10 months ago (01 Dec 2019) |
| 7.0 | 10 years ago (03 Dec 2015) | Ended 8 years ago (04 Jan 2018) | Ended 7 years ago (10 Jan 2019) |
| 5.6 | 12 years ago (28 Aug 2014) | Ended 9 years ago (19 Jan 2017) | Ended 7 years ago (31 Dec 2018) |
| 5.5 | 13 years ago (20 Jun 2013) | Ended 11 years ago (10 Jul 2015) | Ended 10 years ago (21 Jul 2016) |
| 5.4 | 14 years ago (01 Mar 2012) | Ended 12 years ago (14 Sep 2014) | Ended 11 years ago (14 Sep 2015) |
| 5.3 | 17 years ago (30 Jun 2009) | Ended 15 years ago (30 Jun 2011) | Ended 12 years ago (14 Aug 2014) |
| 5.2 | 20 years ago (02 Nov 2006) | Ended 18 years ago (02 Nov 2008) | Ended 15 years ago (06 Jan 2011) |
| 5.1 | 20 years ago (24 Nov 2005) | Ended 20 years ago (24 Aug 2006) | Ended 20 years ago (24 Aug 2006) |
| 5.0 | 22 years ago (13 Jul 2004) | Ended 21 years ago (05 Sep 2005) | Ended 21 years ago (05 Sep 2005) |
At present, only PHP 8.2, 8.3, 8.4, and 8.5 receive official security updates, and PHP 8.2 reaches end-of-life on December 31, 2026.
Older branches were patched for these specific vulnerabilities, but they remain unsupported and may contain other unresolved issues.
We strongly recommend upgrading to a supported PHP version to minimize risk and keep your site protected.
If you have questions about your PHP version or the patch status of your account, open a ticket with our team — we’re glad to help.