PHP2Shell flaws trigger industry-wide patching scramble; CVE-2026-98432 Linux TCP bug hits without authentication
My Take
What happened Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) went live on October 21 and are actively exploited in the wild, while a separate use-after-free flaw in the Linux kernel's IPv4 TCP stack (CVE-2026-98432) can be triggered by remote unauthenticated attackers during the handshake.
Why it matters to hosts If you run shared hosting on cPanel, Plesk, or direct VPS services, you need to patch both PHP and your kernel now — these are not theory problems. PHP2Shell affects 16 active PHP versions, not four, and the TCP bug can give root access to any server running an unpatched kernel, no account required.
What to do Audit your PHP versions in production (not just the ones the PHP project patched) and cross-check against your kernel version; if you use Imunify360's HardenedPHP, verify it hasn't silently blocked updates on your cPanel servers.
My view This week exposed a real fault line in how hosting infrastructure patches work: the difference between what upstream fixes and what actually runs in production. GoDaddy's ability to patch all WordPress Managed Hosting by 19:30 UTC on October 21 is the exception, not the rule. Most of us run custom PHP from vendors, older kernel versions, or security wrappers that can interfere with updates. The TCP bug is worse because it's kernel-level and you can't mitigate it at the application layer — you have to reboot.
How many of your servers are still running unpatched PHP or kernels more than a week after the fixes were available, and what's blocking your updates?
Key Themes
Notable Players
Patched all PHP versions on Managed Hosting for WordPress within 11.5 hours of PHP2Shell fix release (by 19:30 UTC October 21); Web Hosting servers required additional time due to custom vendor PHP packages.
Published urgent advisories for both CVE-2026-98432 and PHP2Shell; identified that PHP2Shell affects 16 active versions but only four received upstream patches.
Released security updates for PHP2Shell CVE-2026-109618 and CVE-2026-109619 and documented affected versions in hosting control panel context.
Shifted production capacity from consumer CPUs to data center server CPUs to meet AI demand; Fab 28 explosion in Israel will cause $600M loss and six-month manufacturing disruption.
Installing AI accelerators at a rate of one every 14 seconds and targeting $1 trillion annual revenue.
Top Stories
GoDaddy patched all WordPress Managed Hosting by 19:30 UTC on October 21, but Web Hosting servers required longer due to custom vendor PHP packages. Hosting control panel operators and independent providers had widely divergent patch speeds.
CVE-2026-98432 is a use-after-free flaw in the Linux kernel's IPv4 TCP code triggered by unauthenticated remote attackers during TCP handshake. Anthropic's Claude successfully built a working root exploit, but major Linux distributions have not yet released patched kernels.
WordPress 7.1.4 released October 28 fixes 22 vulnerabilities including a race condition in the core update mechanism that could allow remote code execution. WordPress hosting providers must update all customer sites immediately.
Intel's Fab 28 facility in Israel experienced a deadly explosion causing a two-week shutdown and $600M loss. The incident will disrupt Xeon server CPU shipments for six months, compounding the AI accelerator supply shortage.
Intel is redirecting chipmaking and advanced packaging capacity across the U.S., Ireland, and Malaysia away from consumer CPUs to meet surging AI data center demand. The shift reflects the largest supply shortage Intel has faced.
Security & Compliance
CVE-2026-98432 is a use-after-free flaw allowing remote, unauthenticated attackers to trigger a timing race in the Linux kernel's IPv4 TCP code. CloudLinux has documented the exposure and patching status for servers using its platform.
eMudhra-issued certificates can be compromised with only four possible keys, allowing attackers to forge HTTPS connections on unpatched sites. Cloudflare details the vulnerability, exploitation evidence, and rapid patching response across its platform.
When PHP2Shell was patched on October 21, the PHP project released fixes for only four versions, but hosting servers in production run at least 16 active PHP versions. This mismatch left many shared hosting and VPS servers exposed.
Plesk released security updates on October 21 for PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619, which allow remote code execution. Both flaws are actively exploited and affect the hosting control panel environment.
CISA has added both PHP2Shell flaws to its list of actively exploited vulnerabilities. Security researchers have confirmed working exploits allowing attackers to gain shells on vulnerable servers.
123 Reg disclosed a breach of customer data attributed to an AI-enhanced cyberattack; company suspects links to ARTEX attackers who previously breached South Korean financial institutions. Domain registrars and hosting control panel data remain high-value targets.
LiteSpeed Cache WordPress plugin flaw allows unauthenticated attackers to retrieve admin-level REST API data on servers with specific configurations. Hosting providers running WordPress with LiteSpeed web servers must verify patch deployment.
Analysis argues that PHP2Shell should not surprise us: three-quarters of the web runs PHP, much of it legacy code and outdated versions. The hosting industry's fragmented infrastructure makes coordinated patching nearly impossible.
Imunify360's HardenedPHP feature can silently block PHP and Apache updates on cPanel servers by replacing standard packages. Hosting operators using the paid Imunify360 version must verify that HardenedPHP is not preventing critical security patches.
Commentary examines PHP2Shell as a cautionary tale about vulnerability disclosure practices: keeping security information secret is difficult in an open-source world, but the consequences of public disclosure without adequate coordination time remain severe.
A security researcher's "Steal My Bitcoin" challenge demonstrated that PHP2Shell exploits are trivial to deploy: a hacker successfully breached the deliberately vulnerable test server and claimed the bounty.
Cloud & Infrastructure
AWS is deploying AI accelerators at a massive scale and projecting $1 trillion annual revenue, signaling that cloud infrastructure investment in AI is accelerating beyond traditional hosting and compute offerings.
Nvidia's Vera CPU is now generally available on Oracle Cloud Infrastructure Superclusters, representing Nvidia's expansion beyond its NVL72 accelerator strategy. The multi-gigawatt deployment signals hyperscaler competition for AI infrastructure dominance.
Control Panels
Hands-on review of cPanel installation on a fresh VPS evaluates the hosting control panel's ease of use, SSL certificate configuration, and management workflow for independent hosting operators.
Technology & Tools
Linus Torvalds stated the Linux kernel has moved past stabilization toward a healthier model for AI-generated patch contributions, though machine-made patches often require rewrites before acceptance.
Canonical's Ubuntu 27.04 may include a preview of Core Desktop, advancing its effort to compete in the modern desktop space, though the company still has significant ground to cover.
Systemd now supports Rust, expanding memory-safe language adoption in critical system infrastructure beyond the Linux kernel. This signals continued momentum toward replacing C in core OS components.
Nvidia is committing billions to expand substrate, advanced packaging, testing, and optical components capacity through 2028, directly funding suppliers to secure production and compete with Intel for data center CPU mindshare.
Web Hosting Services
GMO Internet will not restore its Onamae.com Desktop Cloud VPS platform in its current form after attackers planted malicious code in customer environments. The company refuses ransom and offers $1 million bounty for attacker identification.
Hostinger added a dashboard feature allowing shared hosting and cloud hosting customers to verify whether DDoS attacks caused their website downtime. The Anti-DDoS transparency tool helps differentiate DDoS from other infrastructure issues.
DreamHost's web-based File Manager was offline since October 23; the company has expired passwords for some email and FTP/SFTP users as a precautionary measure and is urging all affected customers to reset credentials.
Data Centers
Fujifilm will increase 100TB magnetic tape production by 5x with a $63 million investment, the largest tape-storage injection in 20 years, driven by AI data center archival and backup demand.
AI data center projects are announced faster than they face local opposition delays, but power supply remains the critical constraint. Hyperscale operators are competing for limited grid capacity and must navigate real infrastructure bottlenecks. --- #HostSecure