Following the public disclosures regarding the PHP2Shell vulnerabilities, we would like to provide an update on the technical details and the precautions implemented across the Nywhash and Lunhost infrastructure.
Overview of the Vulnerability
Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities relate to memory management routines inside the PHP core runtime. Under specific conditions involving abrupt bailouts or resource exhaustion, improper memory handling may result in memory corruption on unpatched environments.
Current Status: Following the release of official vendor patches, necessary evaluations were carried out and all relevant runtime packages across our servers have been updated with appropriate precautions in place.
Measures Taken and Updates Applied
Upon reviewing the official security advisories, our infrastructure engineering team completed the following steps:
- Package & Version Updates: PHP environments powering our services have been upgraded to stable releases that include the vendor security patches.
- Rule Adjustments: Inspection rules covering known exploitation patterns have been enabled on our Web Application Firewall (WAF) layer.
- Infrastructure Monitoring: Routine traffic logs and system metrics are continuously monitored to identify and prevent suspicious activity.
Observations and Service Health
In line with broader internet-wide automated scanning following the public disclosure, occasional scanning attempts were noted against our network edge; all such requests were routinely handled without affecting any operations.
Customer accounts, websites, and data remain entirely unaffected. Our infrastructure continues to operate normally in accordance with standard security practices.
If you have any questions, our support team is available as always to assist.