Hosting Security Roundup: October 2026 — PHP2Shell, KVM Escapes and Every CVE That Mattered

TL;DR: October’s story was PHP2Shell — two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution, exploited in the wild before the patches existed and now shipped in PHP 8.2.35–8.5.12 and EasyApache 4 25.91. Around it came a Critical KVM escape (PwnEscape), a CVSS 9.4 SolusVM root RCE, a Critical 9.2 Brotli decoder flaw, a fresh PHP CVE-2026-115560 with details still pending, Plesk’s Roundcube IMAP injection, and a new cPanel WP Toolkit advisory. Patch PHP and kernels first; everything else follows.

If September was heavy, October was relentless — and for once the headline is not a single vendor’s slip but the entire PHP ecosystem. Two critical PHP engine flaws, exploited before they were patched, forced an emergency release that every hosting stack on the planet had to absorb within days. Around that emergency, the usual suspects stayed busy: kernel escape research kept evolving, SolusVM took a root-level hit, and Plesk shipped a Roundcube fix that mail-heavy servers needed immediately. Here is everything we published in October, in plain language, with the fix paths.

This roundup is written for hosting providers, resellers and server administrators running cPanel, Plesk, DirectAdmin, WHMCS, LiteSpeed or CloudLinux — including servers licensed through SharedLicense. Every item links to our full advisory with references to the vendor’s own announcement.

The Story of the Month: PHP2Shell

The PHP project shipped an emergency release on October 21 fixing two critical engine flaws — CVE-2026-109618 (memory corruption during out-of-memory handling) and CVE-2026-109619 (stale global state) — both leading to unauthenticated remote code execution before your application code even runs. Researchers nicknamed the pair PHP2Shell, and the timeline is what makes it serious: Amazon Threat Intelligence recorded exploitation attempts from October 17, four days before disclosure, and public exploits followed quickly.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — with source backports for the 7.4–8.1 branches, which is how cPanel delivered the fix to every EasyApache PHP branch in EasyApache 4 25.91. Ubuntu also shipped the fix, including backports for EOL branches. If you run PHP anywhere, our advisory on the PHP security release has the version table and the interim mitigations — and why they are not a substitute for patching.

And Then: Another PHP CVE, Details Pending

Days after the emergency release, cPanel published an early advisory for CVE-2026-115560 — a new PHP vulnerability with possible remote code execution impact. The full security advisory has not been released yet, so affected versions and scores are not confirmed; cPanel’s interim guidance is a set of PHP INI settings that reduce exposure. Our CVE-2026-115560 advisory tracks it — treat “update PHP immediately” as the standing instruction for November until the full fix lands.

The Kernel Story: Dirty Frag Grew a Family

October confirmed that the page-cache research from earlier this year has become a family. Alongside CopyFail (CVE-2026-31431) and the original Dirty Frag (CVE-2026-43284), October brought “Fragnesia” (CVE-2026-46300) — a variant in the kernel’s ESP/XFRM encryption path — fixed in the AlmaLinux 8 kernel update ALSA-2026:13577. AlmaLinux 10 received its own broad kernel refresh in ALSA-2026:88477, covering 18 CVEs.

DirectAdmin’s forum also carried the mitigation guidance for both: blacklist the algif_aead module for CopyFail, and apply KernelCare or distribution kernel updates for Dirty Frag. Our advisories walk through both: CopyFail mitigations and the Dirty Frag kernel advisory. The rule of October: if your kernel predates these fixes, patch and reboot — kernel fixes do nothing until the server boots into them.

PwnEscape: When a $1M Challenge Finds a KVM Escape

Researchers at pwn.ai disclosed PwnEscape (CVE-2026-99999) — a Critical guest-to-host KVM escape in the Linux kernel’s IPv4 checksum handling, found while attacking Vercel’s $1 million sandbox-isolation challenge. Repeatable host-memory disclosure chains into a full escape from guest to host, confirmed on Linux 6.12 and 7.x kernels. The upstream fix is commit 6785011f8b16; distribution kernels and KernelCare carry it. Full story and fix path in our PwnEscape advisory. Anyone running VPS nodes should read that one twice.

SolusVM: Root RCE Through Template Injection

SolusVM 2 received its own bad news: CVE-2026-105474, a server-side template injection allowing an authenticated user to execute code as root — CVSS 9.4, affecting SolusVM 2 up to 2.0.0-44576. Given that SolusVM credentials circulate among resellers and clients, every affected installation should be updated past the fixed build. Details in our SolusVM advisory.

Control Panels and the Mail Stack

• Plesk: CVE-2026-113386 — IMAP command injection in the bundled Roundcube (authenticated webmail users; fixed in Plesk Obsidian 18.0.81.5 with Roundcube 1.6.20). Plesk also shipped a phpMyAdmin WebAuthn two-factor bypass fix — see our WP Toolkit advisory for the other cPanel-side cross-account issue of the month.
• cPanel: the WP Toolkit received two fixes this cycle — CVE-2026-107663 (cross-account file placement, fixed in WP Toolkit 6.11.5) following CVE-2026-93699 — plus the EasyApache waves below. Update with sudo /scripts/upcp --force.
• DirectAdmin: the forum carried advisories for Bind CVE-2026-94300 (CVSS 8.1, race condition — fixed via your OS’s bind package) and ImageMagick CVE-2026-116149 (stack overflow in bzip2 image handling — relevant to any server using PHP imagick for uploads).
• LiteSpeed: CVE-2026-93903 — the redirect-validation flaw behind the “LiteSpeed 6.3.7 required” advisory, rated CVSS 9.4.
• WHMCS: 9.1.0 shipped two undisclosed security fixes (WHMCS-22707 and WHMCS-26154) — our WHMCS 9.1.0 advisory explains what is known and the update path.

WordPress and the Brotli Surprise

WordPress shipped 7.1.4 late in the month (a multi-fix security release for the 7.1 branch, following 7.1.3) — routine for WordPress, but worth confirming your sites actually received it. The quieter surprise was CVE-2026-111497: NVD rated the Brotli decoder buffer overflow Critical 9.2 — a crafted compressed stream can disclose memory or potentially execute code, and Node.js bundles Brotli, so the fix rode the Node.js October releases into EasyApache 25.92. Our Brotli advisory has the versions and the blast radius, which extends beyond Node to any application linking a vulnerable Brotli library.

EasyApache Kept Shipping

cPanel’s October in one paragraph: 25.88 brought Apache 2.4.69 with twenty CVE fixes; 25.89 patched ModSecurity, OpenSSL, nokogiri and Passenger; 25.90 closed six libcurl vulnerabilities; 25.91 carried the PHP2Shell fixes plus fourteen more curl CVEs; 25.92 followed with the Node.js and Brotli fixes. If your last upcp was before October 21, you are missing all of it — sudo /scripts/upcp --force catches you up in one pass.

Your October Patch Checklist

• PHP everywhere: 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 (or EasyApache 4 25.91+) — and watch for the CVE-2026-115560 fix.
• Kernels: AlmaLinux 8 → 4.18.0-553.180.1.el8_10; AlmaLinux 10 → 6.12.0-211.68.1.el10_2 or later; reboot required. KernelCare covers most of it live.
• SolusVM 2 past 2.0.0-44576.
• Plesk to 18.0.81.5+ (Roundcube 1.6.20 included).
• cPanel/WHM fully current via upcp (WP Toolkit 6.11.5+, EasyApache 25.92+).
• WordPress sites on 7.1.4, and mail clients on the October Thunderbird builds where relevant.
• Review logs for the October 17–21 PHP exploitation window if you patched late.

Frequently Asked Questions

What was the biggest hosting security story of October 2026?

PHP2Shell — the pair of critical PHP engine flaws (CVE-2026-109618 and CVE-2026-109619) allowing unauthenticated remote code execution, exploited before patches were available and fixed in PHP 8.2.35 through 8.5.12 on October 21. Every PHP server needed this update within days.

Which October vulnerabilities require a reboot?

The kernel updates: AlmaLinux 8’s ALSA-2026:13577/92209 and AlmaLinux 10’s ALSA-2026:88477/91565 all require booting into the new kernel. Package updates alone do not protect a running server — or use KernelCare for live patching.

Did anyone exploit the PHP2Shell flaws?

Yes — Amazon Threat Intelligence recorded exploitation attempts from October 17, four days before public disclosure, and multiple public exploits are available. That is why late-patching servers should also review logs for compromise indicators.

What should I prioritize if I can only patch one thing?

PHP first (it runs every site), then the kernel (it runs everything else), then your control panel — cPanel via upcp, Plesk via the panel updater, DirectAdmin via CustomBuild. All three panels shipped October fixes for exactly this reason.

Conclusion

October 2026 was the month the PHP ecosystem rehearsed its worst day — and mostly passed the test. The hosts that came through cleanly were the ones already on an update rhythm: panels current, kernels rebooted, PHP versions tracked. November’s job is finishing that work: the CVE-2026-115560 fix when it lands, kernel reboots verified, and the last stragglers on old PHP branches moved forward. If licensing costs are what keep you behind on updates, fix that part — our cPanel, Plesk, DirectAdmin, CloudLinux and LiteSpeed shared licenses start at a fraction of vendor pricing, and our advisories feed tracks every fix above the moment it ships.

Sources: each item links to our full advisory with vendor references — PHP Group security advisories, cPanel release notes and support KB, Plesk security announcements, DirectAdmin forum, Ubuntu security notices, AlmaLinux errata, Node.js and WordPress release announcements.