On 21 October 2026, a critical security vulnerability in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), was disclosed.
The vulnerability affects PHP itself and, under certain circumstances, could allow attackers to execute malicious code on affected servers. Because the vulnerability exists at the PHP level, WordPress plugins and other security measures within a website cannot prevent it from being exploited. Protection must be implemented directly at server level.
Are my websites at Raidboxes protected?
Yes. We implemented server-side security measures across our infrastructure before the official PHP security updates were released.
After the official patches were released on 21 October, we initially deployed them to all Boxes running PHP 8.2 or higher. Since then, we have also applied the relevant security updates to older PHP versions.
All PHP versions available at Raidboxes are now protected against these known vulnerabilities. Your websites remained online and accessible throughout the update process.
Do I need to take any action?
No, no action is required on your part.
All PHP versions available at Raidboxes have already received the necessary security updates. This also includes older PHP versions below 8.2, for which we have successfully deployed additional security patches (known as backports).
The updates were automatically applied to our servers. You do not need to change your PHP version or make any adjustments to your WordPress website.
Should I still update my PHP version?
In general, we recommend using the latest compatible PHP version to benefit from improved performance and security.
Here's how to change your PHP version in the Raidboxes Dashboard:
Open your Box and navigate to Settings → PHP → PHP Version.
Select your preferred PHP version from the dropdown menu.
Click Save Version. The change takes effect immediately.
Before making the switch, check that your plugins and themes are compatible with the new version and create a backup as a precaution. For more information, see our guide: Change PHP Version.
Change the PHP version for multiple Boxes at once
If you manage multiple websites at Raidboxes, you can update the PHP version for several Boxes at the same time.
In your Box Overview, select the Boxes you want to update using the checkboxes. Then click Select Action → Change PHP Version, choose your preferred version and confirm by clicking Execute.
The changes are automatically applied in the background. Once all actions have been completed, you'll receive an email notification.
For more information, see our guide: Perform Bulk Actions on Boxes.
What has Raidboxes done to protect websites?
As soon as the first information about the vulnerability became available, our technical team worked with team.blue to implement preventive security measures at server level.
These measures restricted the known attack methods even before the official PHP patches were released.
On the afternoon of 21 October, the official PHP security updates were released. Shortly afterwards, we completed the automated rollout across our infrastructure.
Additional security patches have also been deployed for older PHP versions, ensuring that all PHP versions available at Raidboxes are protected against these vulnerabilities.
Have any websites at Raidboxes been affected by the vulnerability?
We currently have no indication that any websites hosted on our infrastructure have been compromised through this vulnerability.
We continue to monitor the situation closely and will adjust our security measures if new information about the vulnerability becomes available.
If you have any questions about your Box or PHP version, you can contact our support team at any time via the chat in your Raidboxes Dashboard.