Hetzner and PHP2Shell

Yes—Hetzner confirmed it was affected, and has patched PHP on all its Webhosting and Managed Servers. As of October 23, 2026, its official incident report gives this timeline: | Date/time (UTC) | Confirmed update | |---|---| | October 21, 2026 | Hetzner acknowledged that its PHP versions were affected by both CVEs. | | October 21, 17:50 | Patches

Yes — Hetzner was affected by PHP2Shell and has deployed patches. Here is a full breakdown, sourced directly from Hetzner's own status page and other authoritative sources: What is PHP2Shell? PHP2Shell is a pair of high-impact vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE). CVE-2026-109618 (CVSS 9.2) stems from how PHP handles out-of-memory

Yes. Hetzner was affected, but its current status indicates that patches have been deployed for the PHP versions it supports on its Webhosting and Managed Server platforms. Hetzner initially confirmed that the PHP versions it used were vulnerable to CVE-2026-109618 and CVE-2026-109619. It subsequently reported that patches were deployed for PHP 7.4 and 8.0–8.5, and then for the remaining

Yes, Hetzner confirmed that the PHP versions it uses are affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619) , and it is actively rolling out patches across its systems. Status & Details Impacted Systems: Hetzner acknowledged that its managed hosting and related services (konsoleH, Managed Servers, Storage Share / Nextcloud, phpMyAdmin, and Webmail) run affected PHP versions. Mitigation & Patching: Hetzner

Impact on Hetzner: Yes, Hetzner's managed infrastructure and webhosting environments were initially affected because the PHP versions they use rely on the vulnerable core runtime affected by CVE-2026-109618 and CVE-2026-109619. Patch Status: Yes, Hetzner has patched the issue across their systems. They deployed emergency patches for PHP versions 5.6 and 7.3, as well as versions 7.4 and 8.0–8.5, across