Learn from real deployments: Hosting insights and topics that help you ship faster and scale smarter
PHP published fixes for the PHP2Shell vulnerabilities on 21 October 2026. Customers with Imunify360 installed on their managed VPS had already received new firewall rules that blocked the known attack before PHP’s fixes became available. No Layershift customers are known to have been affected.
Last updated: 27 October 2026, 19:22
On 21 October, the PHP development team released emergency fixes for two critical vulnerabilities (php2shell), CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10.
You won't realise it at the time, but the hundreds of decisions you silently make (or these days, maybe your AI agent makes on your behalf?) when starting a new project determine how painful you'll find the inevitable security patching it needs throughout the rest of its lifetime.
Five hours. That is the activity-weighted median time from disclosure to first exploit that Patchstack recorded in 2025 for the WordPress vulnerabilities attackers targeted most heavily (Patchstack, State of WordPress Security in 2026).
Look up how much RAM a WordPress VPS needs and two figures appear again and again: 4GB, or 8GB to be safe. Both are sensible starting points, but neither tells you whether it's enough for your website.
If you're considering a move to a new hosting provider, there's usually a good reason behind it, and often a fair bit of hesitation alongside it. That's understandable. Your website or application matters to your business, and the idea of moving it somewhere new naturally raises questions. What if something breaks along the way? What if customers notice? What if it all takes longer than expected?