Move to Netslim for free
We move your site for free and without downtime. You first see it on a test address, then the DNS is switched. We check right away which PHP version your site uses, and tell you if it no longer gets updates.
Free migrationNews · the PHP vulnerability of October 2026
PHP2Shell vulnerability: what Netslim does for you
On October 21, PHP released an emergency update for two critical vulnerabilities, called PHP2Shell. Websites went offline as a precaution worldwide, including in the Netherlands. If you host with Netslim, we install the update on all our servers. You don't need to log in, click anything or lose sleep over it.
$ netslim status php2shell
lek CVE-2026-109618, CVE-2026-109619
ernst 9,2 van 10 (kritiek)
gevolg code uitvoeren op de server
geraakt elke site op PHP, ook WordPress
update 21 oktober, 16:00
$ netslim wat-doe-ik
netslim update op alle servers
netslim oude PHP-versies: wij bellen jou
edge extra filter vóór je server
jij niets
Fair is fair
Nobody was immune to this beforehand.
Nobody was immune to this beforehand.
Neither were we.
The vulnerability is in PHP itself, not in WordPress or a plugin. Every server that runs PHP needs the update, at every host. Anyone who says it couldn't have happened to them isn't telling you the truth.
The difference is in what happens next. Who keeps an eye on the news? Who installs the update, and how fast? And who calls you if your site runs on a version that no longer gets updates? At Netslim, that's us.
> managing your own server
- Follow the news yourself
- Be ready to update at 16:00
- Find out yourself which PHP versions you run
- Move and test old versions yourself
- Unsure? Then take your site offline
> at netslim
- We follow PHP and the European cyber agency
- The update is installed automatically on all servers
- We know which site runs on which version
- Old version? Then we will contact you
- You do nothing
What we do
Five locks on the door,
Five locks on the door,
without you noticing a thing
The PHP update is the real answer. The rest keeps you safe in the hours around it, and makes sure there is always a way back.
You can see the current status on our status page.
We follow the news for you
We follow the notices from PHP itself and from CERT-EU, the cyber service of the European Union. That is how we knew a day ahead that the update was coming.
The update runs automatically
The operating system, PHP and server management are updated automatically on our servers. As soon as the new PHP versions are ready for our servers, they go live. Your site does not need to go offline for this.
Old PHP version? Then we will call you
PHP 8.1 and older no longer receive updates. If your site runs on it, we will contact you and help you move to a secure version. You can also switch yourself, with one click in your account.
An extra filter on Netslim Edge
If your site runs behind Netslim Edge, a filter blocks known attacks on this vulnerability before they reach your server. Large uploads are also scanned as they come in. This is an extra lock, but the update is still the real answer.
A backup every day
We make backups every day. If something does go wrong, we restore your site to a version from before the problem.
The vulnerability in plain language
What is going on?
> what is PHP?
The programming language that about 70 percent of all websites run on. WordPress, WooCommerce, Magento, Joomla and Drupal all use PHP.
> what can an attacker do?
Run your own code on the server through an ordinary request over the internet. That lets an attacker take over the site and reach all the data on it.
> why the rush?
Once the update is out, criminals can also see where the hole was. With AI they write an attack for it in hours, where that used to take days.
> which versions get an update?
The safe versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12, released on 21 October. PHP 8.1 and older no longer get an update from PHP itself. These need to move to a newer version.
> why did sites go offline?
The advice from CERT-EU: if you can't update right away, take your site offline until you can. That applies to anyone who has to install the update themselves.
> what is it called?
The vulnerabilities are officially called CVE-2026-109618 and CVE-2026-109619, and together they are known as PHP2Shell. Both score 9.2 out of 10.
Is your site running somewhere else?Next time you don't have to
Next time you don't have to
follow the news
Stay where you are, with Netslim Edge in front
Netslim Edge sits in front of your site and blocks known attacks, even if your site runs with another host. Your host still has to install the PHP update themselves.
View Netslim EdgeYour own server? We can help
Do you manage a server yourself and want help with the update, or are you not entirely sure about it? We will check it with you, and if you suspect a hack, we help you first.
Contact usFrequently asked questions
Good to know
Do I need to take my site offline at Netslim?
No. The advice to go offline as a precaution is for people who can't install the update quickly themselves. With us, we install it. If your site runs on PHP 8.1 or older, we will contact you.
Do I need to do anything myself?
No. The update is applied automatically on all our servers. If you want to be sure your site runs on a version that still gets updates, check Hosting in your account. You can also switch PHP version there with one click.
Does my site run on PHP?
If you use WordPress, WooCommerce, Magento, Joomla or Drupal, it does. A site that only consists of separate HTML files does not.
How do I see which PHP version my site uses?
At Netslim, in your account under Hosting. If your site runs on WordPress elsewhere, you can see it in WordPress under Tools, Site Health, Info, Server.
Does this cost anything extra?
No. Updates are part of your hosting, and switching PHP version is free too. If your site does not work well on a newer version, we will tell you in advance what is needed.
How do I know the update is installed?
We keep track of what is going on on our status page. If you have a question about your site, send us a message or a WhatsApp.
I think my site has already been hacked. What now?
Contact us right away. If you suspect a hack, we help you with priority, even if your site does not run with us. Do not change anything on the site before we have looked at it. This keeps the traces intact.
Sources: the announcement from the PHP security team at php.net and the advisory from CERT-EU. Official advisory: php.net, 21 October 2026. Last updated on 21 October 2026.
