PHP2Shell Security Vulnerabilities - Are My Websites Protected?
You may have seen recent news reports about critical security vulnerabilities affecting PHP, commonly referred to as PHP2Shell. These vulnerabilities have received widespread coverage in the mainstream media, and we understand that customers may be concerned about the security of their websites.
We want to reassure customers that 20i has already applied the necessary security patches across our managed hosting platform, including backporting fixes to older PHP versions.
Which 20i hosting services have been patched?
The security updates have been applied automatically to PHP versions provided and managed by 20i across our hosting platform.
This includes:
- Web Hosting and WordPress Hosting
- Reseller Hosting
- Managed Cloud Servers
- Managed VPS
All PHP versions available through these managed hosting environments have received the relevant security fixes.
Are older PHP versions protected?
Yes. All PHP versions provided through our managed hosting platform have been patched against PHP2Shell, including legacy versions.
This includes:
- PHP 5.3, 5.4, 5.5 and 5.6
- PHP 7.0, 7.1, 7.2, 7.3 and 7.4
- PHP 8.0, 8.1, 8.2, 8.3, 8.4 and 8.5
Where necessary, we've backported the security fixes to older PHP versions. This means the relevant security patches have been applied without requiring customers to upgrade to a newer PHP release.
Do I need to upgrade to PHP 8.5?
No. You do not need to change your PHP version to benefit from the PHP2Shell security patches on our managed hosting platform.
While we always recommend using a modern, supported PHP version for general security, performance and compatibility, upgrading specifically in response to PHP2Shell is not necessary.
For example, a website running PHP 7.4 on our managed hosting platform has received the relevant security fixes, just as a website running PHP 8.5 has.
How can I check and manage PHP versions across my websites?
If you manage multiple websites, particularly through a Reseller Hosting account, you can use our Bulk PHP Management tool to review and manage PHP versions centrally.
The tool is available through Manage Hosting > Tools > Bulk PHP Version Manager and allows you to:
- View PHP versions across your hosting packages without having to access each website's individual control panel.
- Identify websites running older PHP versions, helping you plan future upgrades.
- Change PHP versions in bulk, making it easier to manage large numbers of websites.
This is particularly useful for resellers managing dozens or hundreds of websites, as it provides a central location to review PHP versions and make changes where necessary.
Remember: You do not need to upgrade your websites' PHP versions specifically because of PHP2Shell. All PHP versions provided through our managed hosting platform have already received the relevant security patches, including older versions.
While we recommend keeping PHP up to date wherever possible, you should also consider website compatibility before making changes, particularly for websites using older WordPress themes, plugins or applications.
Do I need to take any action?
If your websites are hosted on our managed hosting platform, no action is required.
The necessary security updates have already been applied automatically, including to older PHP versions through backported fixes.
If you have an Unmanaged VPS, PHP updates are your responsibility and are not automatically applied by 20i.
You should check which PHP versions are installed on your VPS and ensure the relevant security patches have been applied. Depending on your operating system and PHP installation, these updates may be available through your operating system's package manager or PHP software provider.
Our System Administrators will continue to monitor developments and apply any further necessary security updates to our managed hosting platform.