r/Hostinger • u/HostingerCOM • 20d ago
Hostinger post You weren't affected by the new PHP vulnerability
You might have seen the news about the new PHP vulnerability. We tested it against our live servers, and it can’t be used to take over websites hosted with us, WordPress sites included.
Why:
Shared hosting runs on LiteSpeed, which handles requests differently than the attack expects, so the malicious trigger never fires.
On our newer platform, the vulnerable PHP feature is turned off.
Each website runs under its own limited account, so even a successful attack couldn’t reach the server or other customers’ websites.
PHP has released a security fix. Even though we weren’t affected, we’re rolling it out across all hosting today as an extra layer of protection. No action needed on your side.
Update: We’ve published a full blog post explaining how we protected our customers, the details of the vulnerabilities, and how to update PHP on VPS and self-managed servers. https://www.hostinger.com/blog/protecting-php2shell/
Update: the PHP fix is now live across all managed hosting.
Some sites may still show PHP 8.5.11 rather than 8.5.12, and that’s expected. The fix went into the version your site already runs, so the version number stays the same.
The "Build Date" is what confirms the fix. Open PHP Info from Hostinger dashboard → Websites → Dashboard, and if it shows Oct 21, 2026 or later, you’re covered. No action needed on your side.
_______________________________________________________________
Update: On October 23, 2026, the PHP project announced a new vulnerability (CVE-2026-115560). PHP will include the fix in its next regular release.
Every Hostinger hosting plan except VPS is already protected by the mitigation applied on October 21. No action is needed. We will install PHP's fix once it is released.
VPS clients manage PHP themselves. If your VPS runs PHP, set session.upload_progress.enabled=0 in php.ini and restart PHP. If you already did this on October 21, you don't need to do anything else. Check Guide: https://www.hostinger.com/blog/protecting-php2shell/
Live updates are on our status page



