Action Required: Critical worldwide PHP security update (php2shell), please upgrade PHP

Hi everyone,

Just a heads up, you may have already heard about this. This week, PHP released fixes for two critical security issues called php2shell (CVE-2026-109618 and CVE-2026-109619). They let someone run their own code on your server, with no login, just by sending a request to a PHP page. Attack attempts have already been reported.

This is a bug in PHP itself. It has nothing to do with CMS Builder or any other website software. If your server runs PHP and has even one PHP file accessible from the web, it's affected, no matter what else is on it.

This is the most serious PHP security issue we've seen in over 10 years.

What to do: upgrade PHP to one of these versions or newer:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

PHP 8.1 and older are end-of-life, so there's no official release with this fix. The PHP team published fix code for 7.4, 8.0, and 8.1 for people who build PHP themselves, and some hosts and support vendors provide patched versions. If you're on 8.1 or older, upgrade to 8.2 or newer, or check with your host to confirm you're running a patched version.

If you're on shared hosting or aren't sure what you're running, check with your hosting provider. You can see your PHP version in CMS Builder under: Admin → General Settings → Server Info

If you manage your own server: Plesk and cPanel each run their own separate copy of PHP for the control panel, and updating your website PHP doesn't update it. Make sure you're running the latest control panel update, and restart your server after you update.

More details are on the PHP site: https://www.php.net/archive/2026.php#2026-10-21-5

Let me know any questions.

Thanks!