Security Advisory · Action Required

Critical PHP Security Update

PHP upgraded to 8.5.12 to address critical remote code execution vulnerabilities.

What you need to do: Please test your website, plugins, themes, modules and admin panel after the PHP upgrade.

Dear Customer,

As part of our ongoing commitment to hosting security, Xisto Corporation has upgraded the default PHP environment across our hosting infrastructure to PHP 8.5.12.

This security release addresses two critical PHP vulnerabilities, known as PHP2Shell, which may allow unauthenticated attackers to execute malicious code on affected systems.

Security vulnerabilities addressed

CRITICAL VULNERABILITY 01
CVE-2026-109618
Remote code execution via out-of-memory (OOM) corruption.
Improper handling of memory allocation failures can leave internal request data in an unsafe state.
CRITICAL VULNERABILITY 02
CVE-2026-109619
Remote code execution via stale global state (use-after-free).
Internal state may reference memory that has already been freed, creating a potential security risk.
Security action taken

The PHP environment has been upgraded as a security measure. Please ensure your website is functioning correctly after the change.

Website compatibility checklist

Please verify the following areas of your website:

✓ Website frontend
Pages, forms, links and interactive features.
✓ WordPress plugins and themes
Check that installed plugins, themes and extensions load correctly.
✓ Admin panel
Test login, dashboard access and administrative functions.
✓ Modules and custom code
Look for PHP errors, broken integrations or unexpected behaviour.
✓ Business-critical functions
Test payment gateways, checkout, bookings and other essential workflows, where applicable.

Important: Older PHP applications

Some older WordPress plugins, themes and custom applications developed for PHP 7.x or earlier may not be compatible with PHP 8.5.12. This may cause fatal errors, malfunctioning features or inaccessible pages.

We recommend updating outdated components to compatible versions. If an issue occurs, please provide the affected URL and relevant error details to our technical team.

Need technical assistance?

Raise a support ticket through your Xisto Client Area so our team can investigate the issue.

Login & Raise a Support Ticket →

Please include your domain name, affected URL and error details.

Thank you for your cooperation as we work to maintain a secure and reliable hosting environment.

Best regards,
Xisto Corporation
Technical Support Team

Xisto Corporation  |  xisto.com
Security · Reliability · Customer Support


petak, listopad 23, 2026

« Nazad