Critical PHP vulnerabilities: how ProgExpert mobilized to protect your websites

Quality hosting is measured by its speed, stability and the work done behind the scenes to keep it secure. When a major vulnerability emerges, the team’s experience and ability to respond become essential.

In October 2026, the disclosure of two critical vulnerabilities in PHP required a major mobilization at ProgExpert. Technical monitoring, stronger protection, patch deployment, verification and communication with our customers: our team handled every stage with care.

THE CONTEXT AT A GLANCE

Protections reduce exposure. Patches address vulnerabilities. Follow-up verifies the work performed.

Two vulnerabilities requiring a rapid response

The vulnerabilities CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, were rated 9.2 out of 10 under the CVSS 4.0 system. Under certain conditions, they could allow an attacker to execute code remotely in a vulnerable environment.

These vulnerabilities affected PHP itself, a technology used by many websites and web applications. Even a website whose code and extensions were up to date could therefore depend on an environment requiring a patch.

For our team, this situation called for rapid intervention and careful monitoring of PHP’s security recommendations.

Protections already in place before the patches

At ProgExpert, we invest in professional security solutions, including Imunify360, to add several layers of protection to our hosting.

During this event, the web application firewall could already block certain known exploitation attempts before all PHP patches had been deployed. We also updated and verified these protections during our response.

This first barrier reduced exposure, but it did not cover every attack scenario. We therefore continued until the necessary patches had been installed and verified.

Patching, verifying and continuing to monitor

Our response went beyond launching an update.

We checked the PHP versions present in our environments, monitored patch releases and applied the appropriate updates. We then confirmed their presence and verified that active services were using the patched components.

This work is particularly important in a hosting environment where several PHP versions may coexist to meet different websites’ needs.

Our monitoring also continued after the initial fixes. When a supplementary advisory on PHP sessions identified another vulnerability scenario, we checked the recommended protective measures in the configurations reviewed.

Communicating with our customers

We emailed all our customers to inform them of the situation.

For us, service quality also includes this transparency. Our customers need to know that a team is monitoring events, assessing their implications and handling the necessary interventions.

Behind every website are a business, operations and people who depend on its availability. That reality guides our work.

More than 18 years in business and over 25 years of experience among our administrators

Founded in October 2008, ProgExpert now has more than 18 years in business. Our team also draws on administrators who each have more than 25 years of experience in web hosting and custom development.

This experience brings practical knowledge built through projects, technological change and resolved incidents. It helps us understand risks, assess the consequences of an intervention and make decisions suited to customers’ needs.

Tools are becoming more accessible, but administering reliable hosting still requires judgement, a methodical approach and a team that takes responsibility for its decisions.

Artificial intelligence supporting our expertise

Artificial intelligence is also among the tools we use to strengthen our work. It supports our analysis, speeds up certain checks and helps us explore possible solutions more quickly.

Its value nevertheless depends on the expertise of the people using it. They need to provide the right context, assess its suggestions and verify results before intervening in infrastructure.

While AI can also be used to prepare attacks, we put its capabilities to work for defence. Our experience allows us to use these tools with discernment while retaining control over decisions and interventions.

High-performance hosting supported by a committed team

Hosting quality rests on several elements: high-performance infrastructure, professional licences, maintained protections and time dedicated to monitoring and maintenance.

At ProgExpert, these investments come with a human commitment. Our team follows security advisories, analyzes risks, applies patches and verifies the work performed.

Our response to the PHP vulnerabilities illustrates that commitment: providing high-performance hosting maintained with care, supported by experience and strengthened by modern technologies.

EXPLORE FURTHER

Sources and media coverage

These links document the public context of PHP2Shell. The account of ProgExpert’s interventions comes from our team.

Sources consulted on October 31, 2026. External links open in a new tab.