Monday, November, 2nd update: Is your Brownrice hosting account protected from PHP2Shell now?

ALL Gen7 SmartVPSs are now fully patched and protected against PHP2Shell: Yes, fully patched and secure. Customers on Gen6 SmartVPSs are strongly suggested to upgrade to Gen7 (we do this for free), but in the meantime have had configuration changes made to all versions of PHP so that they are currently secured – tho some website functionality may break as a result.

Also, there have been no reports of actual php2shell exploits yet in the wild. It turns out that the reality of this is that it’s incredibly hard to actually exploit.

Friday, October 23rd: Is your Brownrice hosting account protected from PHP2Shell now?

Gen7 SmartVPSs running AlmaLinux: Yes, patched and secure. Only these customers have all PHP versions fully patched. These customers are secured from the PHP2Shell vulnerabilities.

Gen7 SmartVPSs running CentOS: Mitigated, probably secure, for now. These customers have had configuration changes made to all versions of PHP in order to mitigate the PHP2Shell vulnerabilities. While these changes are what are recommended by the maintainers of PHP, it is not yet known how secure these changes actually are. These changes may also negatively affect functionality of your website, especially where forms and uploads occur. We strongly recommend contacting Brownrice and requesting that you have us upgrade your SmartVPS. However, in order for us to upgrade your SmartVPS all of your website’s must be able to run on PHP 7.4 or higher in order to work on our patched and secure AlmaLinux platform. If an upgrade is not possible we recommend that you migrate your DNS to Cloudflare and pre-filter all of your request through their WAF (even their free WAF) which will enable another layer of protection.

Gen6 SmartVPSs: Mitigated, probably secure, for now. These customers have had configuration changes made to all versions of PHP in order to mitigate the PHP2Shell vulnerabilities. While these changes are what are recommended by the maintainers of PHP, it is not yet known how secure these changes actually are. These changes may also negatively affect functionality of your website, especially where forms and uploads occur. We strongly recommend contacting Brownrice and requesting that you have us upgrade your SmartVPS. However, in order for us to upgrade your SmartVPS all of your website’s must be able to run on PHP 7.4 or higher in order to work on our patched and secure AlmaLinux platform. If an upgrade is not possible we recommend that you migrate your DNS to Cloudflare and pre-filter all of your request through their WAF (even their free WAF) which will enable another layer of protection.

Gen6 and Gen7 Virtual Servers: Not secure and will be quickly hacked if not updated! These Root VPSs are not managed by Brownrice and all versions of PHP must be upgraded or have their PHP configurations mitigated by you. If your VPS is based on one of the Brownrice OS templates (most are not) then read here for CentOS 7 mitigation, and here for AlmaLinux9 patching. Again, these VPS customers must take action or your VPS will likely be hacked.

---

Today (10-21-2026) two of the largest vulnerabilities in the history of the internet were disclosed. CVE-2026-109619 and CVE-2026-109618 affect all versions of PHP above 5.4 (which is pretty much every version of PHP) which allows remote attackers to hack into a server running PHP.

It’s estimated that 70% of internet’s websites run on PHP, and at least 95% of Brownrice customer websites run PHP. With the advent of AI the speed at which vulnerabilities like this can be exploited has turned from weeks and months to hours and days. This blog is currently vulnerable, brownrice.com is currently vulnerable, and if your website is hosted on our servers, it’s also vulnerable. (Update: Nearly everything is now patched or has had mitigation applied.)

We’ll be updating this blog with frequent updates, so check here to see the latest. As our team’s focus is 100% on protecting your websites we will only be providing updates here, and not through our normal support channels.

10/22/2026 @12:10pm: All patches and updates are complete. Our managed customers are secure. We’ll be watching for additional patches and mitigations in the coming days and will continue to apply security measures as needed.

10/22/2026 @9:25am: All SmartVPSs and managed hosting plans have been patched or have had the vulnerable PHP modules disabled. See below for details. We’re currently double-checking our work, but are feeling good about our level of protection against these vulnerabilities.

10/22/2026 @7:30am: Mitigation and patch update: We’re patching our last two customer servers this morning, which will complete our security updates for our Managed Services (SmartVPSs). Keep in mind that we are only patching our customers who are hosted with SmartVPSs or customers on shared hosting accounts. Customers with non-managed services will need to patch and protect their own servers. i.e. If your VPS service has “SmartVPS” in the name, we’ve got you covered. If not, its critical that you update your own PHP versions if you are running PHP.

10/21/2026 @9:10pm: Mitigation and patch update: php.ini mitigation for our CentOS 7 SmartVPSs is complete, as are those on dedicated managed servers. We’re still patching our AlmaLinux SmartVPSs and will be working through our Managed dedicated server SmartVPS customers as the evening’s work continues. Our customer facing SmartVPSs are approximately 95% secured now.

10/21/2026 @7:55pm: Mitigation and patch update: php.ini mitigation for our CentOS 7 SmartVPSs is complete. We’re still patching our AlmaLinux SmartVPSs and will be working through our Managed dedicated server SmartVPS customers as the evening’s work continues. Our customer facing SmartVPSs are approximately 85% secured now.

10/21/2026 @6:40pm: Mitigation and patch update: We’re rolling out php.ini mitigation for our CentOS 7 SmartVPSs now. This rollout will likely take most of the evening, but once complete will wrap up our initial security rollout for these two PHP vulnerabilities across our managed customer network.

10/21/2026 @4:35pm: Mitigation and patch update: We’ve completed php.ini mitigation for all Gen6 SmartVPSs and all Webcam Player servers. We’ve completed about 50% of the Gen7 AlmaLinux PHP patches. Next up is to apply php.ini mitigation change to Gen7 CentOS SmartVPSs. And the last thing for today will be to apply php.ini mitigation changes to our old shared hosting servers.

10/21/2026 @4:25pm: PHP mitigation updates to all webcam player servers are complete. These settings should protect our webcam player customers until we can recompile and patch each version of PHP. The standard php.ini settings (see below) have been applied, webservers restarted, and php settings confirmed.

10/21/2026 @4:00pm: PHP mitigation updates to all Gen6 SmartVPSs are complete. These settings should protect our Gen6 customers until we can either upgrade those customers to Gen7 AlmaLinux servers or recompile and patch each version of PHP. These are the php.ini settings that have been applied.

session.upload_progress.enabled Off
memory_limit -1
post_max_size = 8M
upload_max_filesize = 4M
max_input_vars = 1000
max_input_nesting_level = 32
max_file_uploads = 10

10/21/2026 @3:20pm: Currently rolling out PHP mitigation updates to all Gen6 SmartVPSs. We’ve tested all of the php.ini setting updates and are now rolling these out to all Gen6 SmartVPSs.

10/21/2026 @1:50pm: Gen7 AlmaLinux PHP patches are being applied now. Our customers on Gen7 AlmaLinux SmartVPSs are receiving patched versions of PHP now, across all versions of PHP. We anticipate this taking the rest of the day to roll out as we have thousands of VPSs to update.

10/21/2026 @1:30pm: Currently testing PHP mitigation on Gen6 SmartVPSs. Testing so far is going well on these older servers which may not be able to receive PHP patches. If we find continued success in testing we’ll roll them out to all Gen6 SmartVPSs in the coming hours. PHP setting changes are these:

php_admin_flag session.upload_progress.enabled Off
php_admin_value memory_limit -1
post_max_size = 8M
upload_max_filesize = 4M
max_input_vars = 1000
max_input_nesting_level = 32
max_file_uploads = 10

10/21/2026 @1:08pm: Cloudflare is an option, even the free version. If you or your developer has DNS experience then moving your DNS to Cloudflare and routing all of your traffic through Cloudflare can provide you with some level of protection. We can’t help you with this as we’ve got all hands on deck patching servers so we do recommend that you work with someone with DNS experience. Here’s our FAQ on how to set this up: https://support.brownrice.com/content/2/369/en/how-do-i-use-cloudflare-cdn-with-my-smartvps.html Here’s the Cloudflare notice: https://blog.cloudflare.com/php-vulnerabilities-waf-protection

10/21/2026 @12:23pm: Gen7 AlmaLinux PHP will begin updates shortly. Our customers on Gen7 AlmaLinux will automatically receive patched versions of PHP 7.4 through PHP 8.5. The download repos are understandably swamped right now but we’ll be rolling out these updates as soon as we have them downloaded and tested.

10/21/2026 @12:17pm: We use PHP-FPM for our Gen7 VPSs and receive our upstream PHP updates from the Remi repository. Remi (he’s a one-man show) who is currently on vacation, just released patch PHP-FPM versions for AlmaLinux PHP 7.4 through PHP 8.5. We’ve just donated a nice bit of Euro’s to Remi for these updates as he does this for free.

10/21/2026 @12:10pm: We’ve spent the morning researching and have met internally and have solidified our plans for patching and mitigating these vulnerabilities, which we’ll begin rolling out shortly.