Help Centre
Home Hosting PHP

PHP2Shell security vulnerability - important information regarding your IONOS contract

Valid for: All applications and services that use PHP

On October 21, 2026, the PHP project released security updates that fix two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in the core runtime of the widely used PHP scripting language.

Together, these two vulnerabilities are known as PHP2Shell. They allow attackers to execute malicious code and take over the web server without authentication or user interaction. This article provides background information, explains how to check for a possible compromise, and describes the steps you should take.

Key points at a glance

  • IONOS has already installed the official PHP updates on its systems.
  • Most customers do not need to take any action.
  • If you run PHP yourself, for example on a VPS or a Dedicated Server, you must take action immediately.

Warning: Phishing!

Experience shows that fraudsters also exploit incidents that receive as much media attention as PHP2Shell. They send fake emails to obtain login details or try to trick you into revealing sensitive information in other ways.

  • Use the Validation Service to check whether emails claiming to be from IONOS are genuine.
  • Do not run any scripts on your server that do not come from trusted sources.

Change your PHP version in your IONOS account

If you can change your PHP version in your IONOS account, you are not at risk from PHP2Shell, because IONOS manages these PHP versions and keeps them up to date. IONOS has also applied the necessary security updates to PHP versions that are no longer officially supported by the PHP community, so you can continue to use your current PHP version securely.

To change the PHP version, log in to your IONOS account, click Hosting, and then click Manage in the PHP tile. On the PHP Settings page, select the domain, click Change PHP version, select one of the available versions, and click Save. The currently recommended version is marked accordingly.

If you are running your own PHP server

IONOS has already updated its own PHP infrastructure and implemented additional security measures. This does not cover PHP installations that you operate yourself. In such cases, you must take action immediately.

A small audience or a low profile does not protect you as a server operator. Attackers have automated the search for web servers that are vulnerable to PHP2Shell, so even lesser-known websites are being targeted.

In addition to executing malicious code, attackers can exploit PHP2Shell to read server memory without authorisation. By accessing your server processes, an attacker can potentially obtain further information, such as database passwords, session tokens, environment variables, and API credentials. The problem is therefore far-reaching and puts all of your webspace data at risk.

Check your website for signs of a PHP2Shell attack

Security authorities such as the German Federal Office for Information Security (BSI) and CERT-EU recommend the following checks for your webspace or server:

  • Error logs: Look for unusual worker crashes, especially segmentation faults (SIGSEGV).
  • Out-of-memory errors: Look for frequent PHP errors in your logs reporting that the allowed memory size has been exhausted. These out-of-memory (OOM) errors can be triggered by attempts to exploit CVE-2026-109618.
  • Suspicious requests: Check your access logs for unusual multipart/form-data upload requests, especially to pages on your website that do not offer an upload function.
  • New or modified files: Use FTP or a file manager to check whether any unknown .php files (backdoors) have been created, and check your CMS for unexplained admin accounts.

Steps to take after a successful PHP2Shell attack

If you administer your own server, or if you find concrete evidence of a compromise, such as malicious code or backdoors in your webspace, IONOS recommends restoring your data to a state from before the attacks (early October 2026).

Complete the following steps:

  • Restore a clean backup of your webspace data.
  • Update your PHP packages, and then restart all PHP services.
  • Change all passwords and other access credentials, such as API keys.

If you do not manage your webspace yourself

Forward the link to this article right away to your webmaster, IT department, or the digital agency that supports you. Also include a link to official security information, such as the CERT-EU advisory Critical Vulnerabilities in PHP.

Improving the security of your PHP installation

An important step towards improving the security of your webspace is to use current, officially supported PHP versions. As PHP2Shell demonstrates, even current PHP versions can be vulnerable. However, as a general rule, newer PHP versions are more secure.

If you use IONOS PHP Extended Support, you are generally protected. Nevertheless, for the reason mentioned above, you should consider switching to a current PHP version as soon as possible.

Further information

Content