PHP2Shell: your site is protected
You may have seen news this week about PHP2Shell, a pair of serious security flaws in PHP (CVE-2026-109618 and CVE-2026-109619). PHP runs most websites, including WordPress, so it's had a lot of coverage.
If your site is hosted with us, you're protected and you don't need to do anything.
What we did
- The workaround was switched on server-wide on 21 October, the same day the details came out. It turns off the PHP feature the attack relies on: an old way of showing upload progress bars, which modern sites, WordPress included, no longer use.
- We restarted PHP on every hosting account that evening. PHP only reads its settings when it starts, so a site could otherwise have kept running with the old setting for a while. A restart makes sure every site has the protection now.
- We checked every site afterwards to make sure it was still loading normally.
What's next
The permanent fix is an updated version of PHP. It will be installed as soon as it's available, and you won't need to do anything for that either.
Should I change anything on my site?
No. It's always a good idea to keep WordPress, themes and plugins up to date, but nothing on your site needs to change for this one.
If you have any questions, open a ticket or just reply to any of our emails. We're happy to help.
Host it on Gravity Host
Fast UK NVMe hosting, free SSL, daily backups and support from a small UK team. Domains are priced separately, and the renewal price is shown before you buy.
What your hosting includes — Email at your own domain, free SSL, daily backups, website migration and one-click apps all come with every plan. See the full list.
See hosting plans
