Last updated 22nd October 2026
Critical PHP Vulnerabilities (PHP2Shell)
On 21 October 2026, the PHP project released security fixes for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, widely referred to as “PHP2Shell“.
- PHP is the server-side language used by many websites, including sites built on WordPress.
- The vulnerabilities are rated critical, and organisations running PHP are advised to apply the patched releases as soon as possible.
Our Security Status
- All Iptor websites are patched: iptor.com and our customer help and knowledge portals have been updated to patched versions of PHP by our hosting provider.
- No action is required from our customers.
Our Ongoing Commitment
We continue to monitor the situation together with our hosting provider and will update this page if anything changes.
If you have any questions about this notice, please contact us.