SlimbotSince 20 October, there has been much discussion about two critical PHP vulnerabilities, collectively called 'PHP2Shell'. Many websites run on PHP, including Slimbot. Here you can read what is known, what this means for your Slimbot account and what you can do for your own website.
What is happening
- These are two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) with a CVSS score of 9.2. An attacker can use them to execute code remotely (remote code execution).
- The details leaked on 20 October. The official PHP update for PHP 8.2 through 8.5 is scheduled for 21 October 2026, 14:00 UTC (16:00 Dutch time). No official fix is coming for PHP 8.1 and older.
- The NCSC advises updating as soon as possible. A number of Dutch organisations have temporarily taken websites offline as a precaution.
- Reports on abuse are not unanimous: Cloudflare reports the first attacks, other sources have not yet seen confirmed abuse.
What this means for your Slimbot account
Slimbot runs on PHP. That's why we also depend on the update that php.net releases. What we do: install the update as soon as it's available and then check the installation. We only say that Slimbot has been updated once this has been confirmed on our servers. Until then, we'll honestly state here that it still needs to happen.
What you can do yourself: use a strong password, enable the extra login step where possible and watch out for unexpected notifications or unusual activity in your account. If you see anything strange, call 085 060 4471.
What this means for your own website
Slimbot is not a hosting provider and does not manage your website. If you have your own PHP site, such as WordPress or WooCommerce, ask your hosting provider or web developer which PHP version is running and whether the update is being installed. If your site runs on PHP 8.1 or older, there is no official fix and switching to a newer version is the only solution.
Sources
NOS (nos.nl/artikel/2636055), Sansec (sansec.io/research/php2shell), Huntress (huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities), Patchstack, Computable and the advisory on php.net. Central facts page: itlive.nl/php-lek. Facts may change rapidly.
Frequently asked questions
Has Slimbot already been updated against the PHP vulnerability?
Not yet. We will install the update as soon as it becomes available and report here once that has been confirmed.
Do I need to do anything in my Slimbot account?
No action is needed for the update itself. However, a strong password with an extra login step is always sensible.
Does this also apply to my own website?
If your site runs on PHP, yes. Ask your hosting provider or web developer about the PHP version and the update, or have it checked.
Read more
Have your website checked too?
The free external check costs nothing. The check & fix with resolution costs €37.50 excl. VAT, until 4 November 2026.
View the PHP vulnerability check & fix → Free external checkPrefer to call? 085 060 4471