Measures Recent PHP Vulnerabilities (PHP2Shell)
- Wednesday, 21st October, 2026
- 18:51pm
On October 20, 2026, two critical vulnerabilities were discovered in PHP (CVE-2026-109618 and CVE-2026-109619, also known as PHP2Shell). These vulnerabilities allowed unauthenticated remote code execution (RCE) under certain conditions. The PHP development group has since released official patches to resolve these issues.
To ensure the security of our environment and prevent any potential damage, XinsHosting took immediate precautionary action and temporarily brought the systems offline.
Current Status of Our Systems:
- Back online: The Web Hosting environment, the Game Hosting panel and the VPS control panel.
- Please note: The game hosting servers themselves remain accessible and can still be played on.
What Does This Mean for Web Hosting Customers?
As a precautionary measure, we have disabled the file upload feature within PHP for versions older than 8.1. This feature will not be re-enabled for these older versions.
If you wish to use file uploads again, you must select PHP 8.2 or higher, as these versions contain the security fixes.
Our Recommendation to You:
We advise all customers to log into the web panel via https://web1.loghierin.nl and check the selected PHP version for your website(s).
How to check this: In your website's Plesk dashboard, navigate to Dev tools and then select PHP.
Minimum versions containing the fix: Ensure your website is running on at least one of the following patched versions:
- PHP 8.2.35 (or higher)
- PHP 8.3.36 (or higher)
- PHP 8.4.27 (or higher)
- PHP 8.5.12 (or higher)
If you have any questions, our support team is ready to help you.
