PHP vulnerability PHP2Shell – important information

PHP vulnerabilities (PHP2Shell): what do they mean for your STRATO product?

In this article, we tell you about two critical vulnerabilities in PHP, also known as "PHP2Shell". You will find out whether your STRATO product is affected, what you need to do and how to protect yourself from fake emails.

The key points in brief

• We have already installed the official PHP security update on all the platforms we run ourselves. If your website is hosted with STRATO, you don't need to do anything.
• If you run PHP yourself, for example on a VPS or dedicated server, you should install the latest PHP version straight away.
• Beware of phishing: don't click on links in emails that refer to the PHP vulnerabilities, and don't enter your login details there.

What has happened?

On 21 October 2026, the PHP community announced two critical vulnerabilities in the PHP core and released security updates at the same time. These vulnerabilities could allow attackers to run their own code on a website and so gain access to that website's data.

PHP installations worldwide are affected, regardless of the hosting provider. PHP is a scripting language used by WordPress, Joomla and Drupal, among others.

We put extra protective measures in place before the updates were released: our hosting platforms had adapted PHP configurations and firewall rules in place that block suspicious requests. These measures reduce the risk, but they do not close the vulnerabilities permanently. Only the official update does that.

Am I affected as a STRATO customer?

That depends on how you use PHP:

Please note: You don't need to take your website offline. All the temporary restrictions we put in place as a precaution have been lifted. File uploads are working as normal again.

Am I protected with STRATO PHP Extended Support?

If you use the paid STRATO PHP Extended Support service, you are protected too. We have applied the security update to the older PHP versions that the PHP community no longer supports, and installed it on our platforms. You don't need to do anything.

This applies to PHP versions 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1. [PHP 4, 5.2, 5.4 and 5.5 for older products]

Please note: Even with Extended Support, we recommend switching to a current PHP version soon. To find out how, see: How do I change my PHP settings in my hosting package?

How do I check my PHP version in the STRATO customer login?

With STRATO hosting, you can see the PHP version in use in your package. Here's how:

1. Log in to your STRATO customer login.
2. Select your hosting package.
3. In the menu, click Databases and Web space → PHP version settings.
4. Here you can see the version you're currently using. You can currently choose from versions 8.2, 8.3, 8.4 and 8.5. The recommended version is marked.

To find out how to change the version, see: How do I change my PHP settings in my hosting package?

Tip: Wherever possible, always use a current PHP version that is supported by the PHP community. Newer versions are generally better protected.

What do I need to do if I run PHP myself?

If you run PHP yourself, for example on a VPS or dedicated server, you need to install the update yourself. Having a small audience or a low profile won't protect your website, as attackers scan the internet for vulnerable systems automatically.

1. Find your PHP installations: Check everywhere PHP is running. Also think about software that comes with its own PHP, control panels and content management systems.
2. Install the current PHP version: Install the current PHP version straight away, starting with systems that can be reached from the internet. Then restart all PHP services.
3. Replace outdated versions: There may be no update for older PHP versions that are no longer supported. Plan an upgrade, or restrict access to these systems until you have switched.
4. Keep backups ready: Make sure you have recent, tested backups.
5. Watch for anything unusual: Monitor your system for the signs listed below.

Note: If an agency or your IT department manages your website or server, please forward this article to them straight away.

How do I spot a possible compromise?

If an attack is successful, signs can include the following:

• unfamiliar files in your website directory, or files that you haven't changed yourself
• unknown admin users or new accounts in your CMS
• unexpected scheduled tasks (cron jobs)
• unexplained high server load or unusually heavy traffic
• redirects, spam content or unexpected emails sent from your website

If you notice any of these signs, we recommend that you:

1. Change your passwords and login details straight away (for example for your database, CMS, SFTP and API access), using a clean device that hasn't been affected.
2. Don't delete any files or logs for now, so that the incident can be traced.
3. If necessary, restore a clean backup of your website, then update PHP and your applications.
4. Contact our customer service team via our Help & Contact page → Contact.

How do I protect myself from phishing emails?

Fraudsters often take advantage of events that get a lot of media attention. They send fake emails to get hold of login details.

• Don't click on links in emails that refer to the PHP vulnerabilities.
• Don't enter any login details there.
• If you have already entered details, change your password in the STRATO customer login straight away.
• Don't run any scripts on your server that don't come from trusted sources.

You can find more on this topic in our article What are Phishing emails and what do I need to be aware of?.

Related articles

• What is PHP and how do I use it?
• How do I change my PHP settings in my hosting package?
• What is STRATO PHP Extended Support?
• CERT-EU Security Advisory