Customer Security Checklist and Expert Assistance Guide

Security advisory period: October 2026
Vulnerabilities: CVE-2026-109618 and CVE-2026-109619
Applicable environments: cPanel, Plesk and other Linux-based hosting control panels
Server-side security patching: Completed

1. Security Advisory – Why Customer Action Is Required

Our hosting team has completed the required server-side security patching related to the PHP2Shell vulnerabilities.

However, during the vulnerability exposure period, individual hosting accounts may have been accessed or modified without authorisation.

Server patching prevents further exploitation through the patched vulnerability, but it does not automatically reverse changes made to individual hosting accounts before patching.

Potential account-level changes include:

• Malicious PHP code injected into existing website files.
• Hidden PHP backdoors embedded in legitimate application files.
• Unauthorised PHP scripts or executable files.
• Modified PHP configuration files.
• Unauthorised FTP, SSH or control-panel access.
• Unknown website administrator accounts.
• Malicious scheduled tasks.
• Database-level code injections.
• Hidden scripts that recreate deleted malicious files.
• Changes to website redirects, application settings or external resource references.

Some of these changes may not be visible during normal website usage or detected by routine malware scans.

All customers are requested to complete the following 14 security checks, even if their websites are currently working normally.

2. Customer Security Checklist – 14 Mandatory Checks

Check 1 – Secure Your Hosting Control Panel Account

• Change your existing hosting control panel password.
• Use a strong and unique password.
• Enable Two-Factor Authentication (2FA), where available.
• Secure the registered email account.
• Do not share hosting credentials with unauthorised individuals.

Check 2 – Review Hosting Users and Account Permissions

• Review all additional hosting users.
• Identify unfamiliar or unauthorised users.
• Remove users who are no longer required.
• Review website and subscription access permissions.
• Investigate unexpected changes to account ownership or permissions.

Check 3 – Review FTP and SFTP Accounts

• Review all FTP/SFTP accounts.
• Remove unfamiliar accounts.
• Change existing FTP/SFTP passwords.
• Check the directories assigned to each account.
• Ensure access is limited to the required website directories.

Check 4 – Review SSH Access and Authentication

• Disable SSH access if it is not required.
• Review authorised SSH public keys.
• Remove unfamiliar SSH keys.
• Change potentially exposed SSH credentials.
• Investigate unexpected shell access or remote login activity.

Check 5 – Inspect Website Files and Directories

• Review the website document root.
• Look for unfamiliar PHP files.
• Check recently modified files.
• Review upload, cache and temporary directories.
• Investigate executable PHP files inside image or document upload folders.
• Look for unfamiliar filenames and hidden files.

Check 6 – Inspect PHP Configuration and Website Settings

• Review .user.ini.
• Review php.ini.
• Review .htaccess.
• Review application configuration files.
• Investigate unexpected auto_prepend_file and auto_append_file settings.
• Check for unfamiliar PHP file inclusions and rewrite rules.

Check 7 – Check for Malicious PHP Code Injection

• Review PHP files for unexpected code modifications.
• Inspect website entry-point files.
• Check application bootstrap and configuration files.
• Investigate suspicious encoded or obfuscated PHP code.
• Look for unfamiliar external script references.
• Check for unexpected redirects and hidden iframe injections.
• Compare suspicious files with trusted application originals.

Note: Functions such as eval(), base64_decode(), gzinflate() and shell_exec() may appear in legitimate applications. Their presence alone does not prove compromise.

Check 8 – Review Website Administrator Accounts

• Review WordPress, Joomla or other CMS administrator accounts.
• Identify unfamiliar administrator users.
• Remove unauthorised accounts.
• Change administrator passwords.
• Review unexpected changes to administrator permissions.
• Remove unrecognised application integrations or API credentials.

Check 9 – Update Website Applications and Components

• Update the website CMS.
• Update WordPress core, where applicable.
• Update themes and plugins.
• Update other application components.
• Remove unused or unrecognised plugins and themes.
• Obtain software only from trusted sources.

Check 10 – Review Scheduled Tasks and Automated Processes

• Review all cron jobs and scheduled tasks.
• Identify unfamiliar PHP execution commands.
• Investigate unexpected remote download commands.
• Check for tasks that modify website files.
• Review automated scripts that recreate deleted files.
• Remove confirmed unauthorised tasks.

Check 11 – Review Website Databases

• Review website administrator records.
• Investigate unknown database users.
• Check for unexpected JavaScript or script injections.
• Review suspicious redirects stored in database records.
• Investigate unexpected application configuration changes.
• Change database credentials if compromise is suspected.

Check 12 – Review Backups and Recovery Options

• Maintain a backup of website files.
• Maintain a database backup.
• Identify a backup from before the suspected compromise.
• Verify the backup before restoration.
• Avoid restoring potentially infected backups.
• Preserve copies of suspicious files for investigation.

Check 13 – Review Website Behaviour and External Connections

• Check for unexpected redirects.
• Check for unfamiliar scripts loaded by the website.
• Investigate unusual website pop-ups or advertisements.
• Check for unexpected changes to website content.
• Review suspicious outbound connections where information is available.
• Investigate unusual website errors or repeated file modifications.

Check 14 – Complete Final Security Verification

• Confirm that all previous security checks have been completed.
• Confirm that unknown users and access credentials have been removed.
• Confirm that suspicious file modifications have been investigated.
• Confirm that website configuration changes are legitimate.
• Confirm that no suspicious scheduled tasks remain.
• Confirm that website administrator accounts are authorised.
• Confirm that the website and database are functioning normally.
• Continue monitoring for unexpected changes or suspicious behaviour.

3. Important – Completing All 14 Checks Does Not Guarantee That the Account Is Clean

Some account compromises may involve changes that are difficult to identify through normal customer-side checks.

For example:

• Malicious PHP code may be embedded within legitimate application files.
• Existing files may be modified without creating additional malware files.
• PHP code may be injected into application configuration files.
• Malicious code may exist within database records.
• Hidden backdoors may use legitimate-looking filenames.
• Persistence mechanisms may recreate malicious files after deletion.
• Unauthorised code may execute without producing visible website errors.
• Modified application files may continue functioning normally while executing additional code.

A website can therefore appear normal even when unauthorised modifications remain.

If you have completed all 14 checks and still suspect suspicious activity, further expert investigation is recommended.

4. Expert Assistance – Manual Account-Level Security Investigation

If customer-side checks do not resolve the issue, customers can request manual security investigation for their individual hosting account.

This assistance is intended for cases where suspicious modifications may exist but are not easily identifiable through standard control-panel checks or automated malware scanning.

The technical team may investigate the following areas.

A. Hidden PHP Code and File-Level Investigation

• Manual inspection of existing PHP files.
• Identification of injected or unauthorised PHP code.
• Investigation of obfuscated code and suspicious execution patterns.
• Comparison against trusted application source files.
• Investigation of hidden PHP backdoors.
• Identification of unexpected file inclusions.

B. PHP Configuration Investigation

• Review of PHP configuration changes.
• Investigation of modified .user.ini and .htaccess files.
• Inspection of unexpected PHP execution directives.
• Identification of unauthorised file-loading mechanisms.

C. Account Access and Persistence Investigation

• Review of suspicious hosting account activity.
• Investigation of unexpected FTP and SSH access.
• Review of unauthorised keys and credentials.
• Inspection of suspicious scheduled tasks.
• Investigation of mechanisms that recreate malicious files.

D. Database-Level Investigation

• Inspection of suspicious database modifications.
• Investigation of injected scripts and redirects.
• Review of unauthorised administrator records.
• Identification of unexpected application configuration changes.

E. Manual Cleaning and Recovery

Where malicious changes are confirmed, the technical team may:

• Remove confirmed malicious code injections.
• Restore affected files from trusted sources.
• Remove unauthorised backdoors.
• Correct unauthorised configuration changes.
• Remove confirmed malicious scheduled tasks.
• Assist with database-level remediation.
• Review access credentials and recommend rotation.
• Perform post-cleaning verification.

The scope and availability of manual cleaning will be determined by the technical support team.

5. Why Firewall and Automated Malware Scanning May Not Be Sufficient

Firewall protection and Imunify malware scanning are useful additional security measures. However, they should not be treated as guaranteed methods of identifying or removing all previously introduced PHP code injections.

For example:

• An injected code segment may be part of an otherwise legitimate PHP file.
• A backdoor may be disguised as a normal application file.
• Malicious changes may exist in database records.
• An attacker may have modified legitimate configuration files.
• Some persistence mechanisms may not be detected by routine scans.

Therefore, an automated scan reporting no malware does not necessarily establish that a previously compromised hosting account is clean.

Manual code-level investigation may be required.

6. When Should You Raise a Support Request?

Please contact our technical support team if:

• Your website continues redirecting visitors.
• Unknown files continue appearing.
• PHP files are repeatedly modified.
• Unauthorised administrator accounts reappear.
• Suspicious code is found inside legitimate application files.
• Your website behaves abnormally despite completing all checks.
• Automated malware scanning reports no infection, but suspicious activity continues.
• You suspect hidden code injection or an undetected backdoor.
• You cannot verify whether modified files are legitimate.

Do not repeatedly delete suspicious files without investigation. Preserve available evidence and request assistance.

7. How to Request Expert Manual Assistance

If the issue is not resolved after completing all 14 checks, please raise a support ticket through our official support portal:

Support Ticket Portal:
https://billing.kakinfotech.co.in/submitticket.php

Select the appropriate support category and provide the following information:

• Domain name:
• Hosting account / subscription:
• Hosting control panel: cPanel / Plesk / Other
• Description of the suspicious activity:
• Approximate date when the issue was first noticed:
• 14-point checklist completed: Yes / No
• Automated malware scan result, if available:
• Suspicious files or screenshots, if available:

Suggested ticket subject:

PHP2Shell – Manual PHP Injection and Hosting Account Security Investigation

Our technical team will review the request and determine whether manual investigation, code cleaning or additional recovery measures are required.

8. Customer Security Completion and Escalation

Please complete the following confirmation after reviewing the 14 security checks.

• I have reviewed all 14 security checks applicable to my hosting account.
• I have completed the recommended account and website security actions.
• I have reviewed suspicious files, configurations and access permissions where applicable.
• I have checked my website and database for unexpected changes.
• I have verified that my website is functioning normally.

If the issue is still not resolved after completing these checks, please open a support ticket using the following link to request expert manual investigation and assistance:

https://billing.kakinfotech.co.in/submitticket.php

Customer / Organisation: ______________________

Domain Name: _________________________________

Hosting Control Panel: cPanel / Plesk / Other

Date: _________________________________________

Support Ticket ID (if raised): ___________________

Additional Observations: ________________________

9. Final Security Notice

The server-side security patching for the PHP2Shell vulnerability has been completed by our hosting team.

Customers must separately review their hosting accounts and websites for potential unauthorised changes that may have occurred during the vulnerability exposure period.

The 14-point checklist is intended to help customers perform initial security checks.

If these checks do not resolve the issue, expert manual assistance is available through our technical support team for account-level investigation and remediation.

A clean malware scan or normally functioning website should not be considered conclusive proof that no hidden PHP code injection or unauthorised modification exists.

Our objective is to help customers secure their hosting accounts, identify possible historical compromise and restore the integrity of affected websites.

Thank you for your cooperation.

Technical Support Team
Hosting Security Operations