RESOLVED: PHP Security Updates Complete

UPDATE - Published October 21, 2026 @ 8:30 PM

Reusser has completed all software patches across our fleet of servers powering our hosting services. If your website is powered by WordPress, WPEngine also completed their upgrades around the same time, which you can see here. If you have additional questions do not hesitate to reach out.

If your website uses Cloudflare’s web application firewall (WAF), it also has an extra layer of protection. Cloudflare has deployed php2shell protections across its free and paid WAF plans. These protections stay in place on top of the server updates we’ve completed.

Our team is still monitoring for any new developments related to php2shell. If new patches, guidance or threats come up, we’ll act quickly to take any remediation steps needed to keep your website secure, and we’ll update this post.

If you have questions about your website’s hosting or Cloudflare coverage, contact the Reusser team or start a Help Desk ticket.

Original Post Published October 21, 2026 @ 3:28 PM

If you host your website with Reusser, our team is actively patching our servers and updating PHP to address the php2shell vulnerabilities. We’ve been prepared to apply these updates since PHP announced the upcoming security release on October 20. The Ubuntu package repository (PPA) we use has been slower than expected as many organizations update at once, which has slowed the rollout. We’re continuing to apply updates as packages become available.

If your website uses Cloudflare’s web application firewall (WAF), you have an additional layer of protection while we complete this work. Cloudflare has deployed php2shell protections across its free and paid WAF plans. These protections help reduce exposure, but server updates remain essential. We’ll update this post once the work on servers we own is complete.

If your site is powered by WordPress, there's a very good chance we have it in our Reusser WPEngine account. Thankfully, WPEngine uses Cloudflare for SaaS to the same WAF protection is in place there. You can track their independent status update here.

If you have questions about your website’s hosting or Cloudflare coverage, contact the Reusser team or start a Help Desk ticket.