Hostinger deploys protections against php2shell PHP vulnerabilities
Updated October 23, 13:25 UTC: The PHP project has disclosed a third vulnerability, CVE-2026-115560. Every Hostinger hosting plan except VPS is already fully protected by the changes we made on October 21, so no action is needed. PHP will include a fix in its next regular release, and we’ll roll it out as part of normal maintenance. If you run PHP on a VPS, set session.upload_progress.enabled = Off in php.ini or your PHP-FPM pool config and restart all PHP workers (see step 2 below). If you already did this on October 21, you’re covered. Live updates are on our status page…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.