DomainMOD Security Notice -- Please Update PHP Now

Thursday, October 22nd, 2026

On October 21st the PHP project released fixes for two critical security vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (nicknamed "PHP2Shell"). They let an attacker run their own code on your server without logging in, just by sending it specially crafted web requests.

These are bugs in PHP itself, not in DomainMOD, but since every DomainMOD installation runs on PHP, every installation is affected until PHP is updated.

If you run DomainMOD using Docker: we've rebuilt the official DomainMOD Docker image on PHP 8.2.35, which includes both fixes. Run docker compose pull and then docker compose up -d to update. Pulling on its own isn't enough, as your container will keep running the old image until it's recreated.

If you run DomainMOD on your own server: update PHP to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 (or newer), and then restart your web server and PHP. PHP 8.1 and older won't receive a fix, so if you're on PHP 8.1 please move to PHP 8.2.35.

If you're on shared hosting or installed using Softaculous: your host controls PHP, so check that they've updated it.

For more details you can view the official security advisories for CVE-2026-109618 and CVE-2026-109619.

Download The Latest Version     More News