No impact incident

Rebel: Urgent PHP Security Update (PHP2Shell)

Current status of Rebel: Operational — live Rebel status

Timeline

1. Oct 22, 2026, 22:18 UTC
   monitoring
   Urgent PHP Security Update (PHP2Shell) On Wednesday, October 21, 2026, the PHP project released an emergency security update addressing two critical vulnerabilities in the PHP core interpreter, tracked as CVE-2026-109618 and CVE-2026-109619 (collectively known as “PHP2Shell”). Both are rated Critical (CVSS v4.0 score of 9.2) and could allow an attacker to run malicious code on a web server running an unpatched version of PHP, without needing to log in. Because details of these flaws became public before the fix was released, and attacks have been observed in the wild, we have treated this as our highest priority. What this means for your domains Domain name registrations, DNS, and email forwarding are not affected. No action is required for your domains. What we have done to protect you All PHP versions on our webhosting servers have been patched to the fixed releases: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If your website uses PHP 8.2 or newer, it is already protected and no action is needed. What you need to do If your website uses PHP 8.1 or older: these versions no longer receive security updates and your website is at high risk of being compromised. Please switch to PHP 8.3 or newer as soon as possible If your website uses PHP 8.2: you are protected, but PHP 8.2 reaches end of life on December 31, 2026. We recommend planning a move to PHP 8.3 or newer. Not sure which version you’re using, or concerned your site may have been affected? Contact our support team.

Updates as published by Rebel (original).