PHP Security Advisory: CVE-2026-109618 & CVE-2026-109619 and your HostBill installation
On October 21, 2026 the PHP project released emergency security updates for two critical vulnerabilities in the PHP engine itself: CVE-2026-109618 and CVE-2026-109619 (also referred to as “PHP2Shell”). These issues are not specific to HostBill. They affect PHP itself, which means every application running on an unpatched PHP version is exposed, including HostBill. Please make sure the server running your HostBill is updated as soon as possible.











