IONOS PHP2Shell status: what IONOS says and how to confirm

IONOS has published a PHP2Shell statement for its own hosting platforms. On that help page, IONOS says it has installed the official PHP updates on its systems and that most customers do not need to take any action. If you run PHP yourself, for example on a VPS or dedicated server, IONOS says you must take action immediately. For your domain, ask support for the build and restart evidence.

What exactly has IONOS said?

At our check on 26 October 2026, three IONOS pages covered it. The help article is titled "PHP2Shell security vulnerability" and says IONOS has installed the official PHP updates on its systems and has implemented additional security measures. The newsroom post says IONOS "has already applied the official update on all platforms the company operates itself" and that customised PHP configurations and firewall rules were active before the updates arrived. IONOS adds that only the official update fixes the bug.

The IONOS status page shows a maintenance incident opened on 21 October and resolved on 22 October. It describes the PHP security update rolling out, with possible short interruptions. It refers to "critical vulnerabilities in the PHP core" and does not name PHP2Shell or the CVE ids.

Two gaps matter. Neither the help article nor the newsroom post gives a fixed PHP build number, and neither shows a publication or last-updated date. Our earlier research snapshot of 22 October found no dated IONOS note, so IONOS's pages may be newer than that snapshot. They do not say which build serves your domain or when its workers last restarted.

Who is affected on IONOS?

It depends on who runs the PHP.

PHP's notice says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. More on the bug is on our PHP2Shell page.

Is the PHP version selector a patch status?

IONOS's PHP settings page lists each domain with its assigned PHP version. That is a branch such as 8.3, not a build. Backports and vendor builds keep the old number, so the selector cannot show whether the fix is in. It also cannot show whether workers restarted. The same IONOS page says old versions get no security updates, and that you cannot change the version on Managed Hosting for WordPress or MyWebsite because IONOS manages it.

See the fixed versions table for why a version string is not proof either way. Other hosts' statements are collected in the other host guides.

How do I confirm my IONOS site is covered?

How do I confirm coverage on IONOS web hosting, where IONOS manages PHP?

To see the PHP version assigned to a domain, per IONOS Help: log in, open the menu in the title bar, choose Hosting, pick the contract, then click Manage in the PHP tile.

Then send support this and keep the reply:

For [your domain], is the PHP runtime that serves web requests patched for CVE-2026-109618 and CVE-2026-109619? Please give the fixed package, build or backport identifier, confirm that all PHP workers serving it have been restarted or replaced, and say whether I need to redeploy or change a setting.

• Note the PHP version shown for the domain and the date you looked
• Send the question above and save the written reply
• Record the build or backport identifier, not only "up to date"
• If the reply says only "managed by IONOS", treat the state as unknown and say so in your records
• If your PHP is 8.1 or older, ask what covers it and plan a move to a supported branch

What do I do if I run PHP myself on a VPS or dedicated server?

IONOS says this is on you (IONOS Help).

• Update PHP from your distribution's packages. The changelog must name both CVEs. Distribution pages: Debian, Ubuntu, Red Hat
• Restart PHP-FPM, or Apache if you use mod_php
• Confirm the PHP that serves web requests, not the command line
• Rebuild and redeploy any container image that bundles PHP

Am I affected? A three-state self-test

Was anything exploited, and what should I look for?

AWS reported honeypot exploitation attempts from 17 October and says it is unclear whether the early ones would have worked on real systems. See is PHP2Shell being exploited for the current picture.

IONOS's help article lists what to check in logs, attributing the checks to the German BSI and CERT-EU: unusual worker crashes (segmentation faults), frequent memory-exhaustion errors, unusual multipart/form-data upload requests to pages with no upload function, unknown .php files and unexplained CMS admin accounts. If you administer your own server or find concrete evidence of a compromise, IONOS recommends restoring your data to a state from before early October 2026, updating PHP packages and restarting PHP services, and changing all passwords and access credentials. The same page warns that fraudsters exploit heavily covered incidents; do not follow links in emails that cite this vulnerability. Our own indicator checklist for a compromised site goes further.

What is the bug, without the exploit?

Both CVEs are memory-safety flaws in the PHP engine, reachable by an unauthenticated web request. CVE-2026-109618 involves out-of-memory handling that leaves request data partly initialised. CVE-2026-109619 involves request state that survives after its memory is freed. We do not reproduce attack material here, and you do not need it to fix your site.

Related reading: the October 2026 tracker and what a checker can and cannot confirm.