Viva Digital has confirmed that proactive security protections have been implemented across our managed hosting infrastructure, helping safeguard client websites against two recently disclosed critical PHP vulnerabilities.
The vulnerabilities, collectively known as PHP2Shell, were publicly disclosed on 21 October 2026 and have raised significant security concerns across the global web hosting industry.
Importantly, protective measures were deployed across our hosting infrastructure before the vulnerabilities were publicly disclosed, reducing the risk of exploitation and providing an additional layer of protection for websites hosted with Viva Digital.
For our hosting clients, no immediate action is required.
What is the PHP2Shell security vulnerability?
PHP is one of the world’s most widely used server-side programming languages, powering millions of websites, including those built using WordPress.
On 21 October 2026, two critical vulnerabilities were disclosed:
- CVE-2026-109618
- CVE-2026-109619
Both vulnerabilities received a critical severity rating of 9.2 out of 10 under the Common Vulnerability Scoring System (CVSS 4.0).
Depending on the circumstances, these security flaws could potentially allow attackers to execute malicious code remotely, disrupt website functionality or expose sensitive information.
Unlike vulnerabilities affecting an individual WordPress plugin or theme, PHP2Shell affects the underlying programming language. This makes the potential impact considerably broader.
How Viva Digital has protected our hosting clients
Following advance notification of the emerging security threat, proactive server-level security measures were implemented across the managed hosting infrastructure used by Viva Digital.
These protections included:
- Server-level security mitigation rules: Protective measures were deployed across the hosting environment to reduce exposure to the identified vulnerabilities.
- Disabling vulnerable PHP functionality: The affected functionality was disabled across supported PHP versions, helping prevent exploitation.
- Proactive implementation: Security protections were introduced ahead of the public disclosure, reducing the period during which websites could otherwise have been exposed.
- Ongoing security monitoring: The vulnerabilities remain subject to monitoring, with further updates and security patches applied as necessary.
Crucially, these measures were implemented at the hosting infrastructure level rather than requiring individual website owners to install updates or modify their WordPress settings.
This centralised approach allows security protections to be deployed efficiently across multiple websites.
Why proactive website security matters
When a critical vulnerability becomes public, cybercriminals can quickly begin scanning websites and servers for potential weaknesses.
The period immediately following public disclosure is particularly important, as attackers may attempt to exploit vulnerabilities before security patches have been widely deployed.
By implementing protective measures ahead of the PHP2Shell disclosure, our hosting infrastructure was better positioned to defend against these threats from the outset.
It’s an important example of why choosing a professionally managed website hosting environment matters.
Website security involves much more than installing WordPress updates. It requires ongoing attention to the underlying server infrastructure, programming languages, security configurations and emerging threats.
Do Viva Digital hosting clients need to do anything?
No immediate action is required from clients whose websites are hosted through Viva Digital’s managed hosting environment.
The relevant PHP2Shell protections have already been implemented at server level.
Clients do not need to independently modify PHP configurations, install emergency WordPress plugins or make changes to their hosting settings in response to this particular vulnerability.
As always, we recommend keeping WordPress, plugins and themes updated and maintaining appropriate website backups as part of a comprehensive security strategy.
Our commitment to secure website hosting
At Viva Digital, we believe website hosting should provide more than simply somewhere for your website to live.
Security, performance, reliability and ongoing technical management are essential to maintaining a professional online presence.
Our managed hosting services are designed to give businesses confidence that their websites are supported by professionally maintained hosting infrastructure and proactive security measures.
The response to PHP2Shell demonstrates the importance of this approach. By addressing security risks at the infrastructure level, we can help protect client websites without creating additional technical responsibilities for business owners.
Your website’s security matters, and we’re committed to ensuring our hosting environment remains secure, reliable and up to date.
