Not entirely. It depends on what you mean by "web apps." On a managed platform, the provider patches the operating system and often the runtime, which is a real advantage. You still own your app's code and its libraries, though.
Two current problems matter here, as of October 22, 2026:
- PHP2Shell (CVE-2026-109618 and CVE-2026-109619): two critical flaws in the PHP runtime itself, rated 9.2 by PHP and fixed on October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA urged immediate patching and said it had not yet seen exploitation, but security firms now report attempts in the wild. If your app runs PHP, this is the first thing to check. Versions 8.1 and older get no new release, so they need a host-level fix. Full details are in CISA's alert.
- Linux kernel flaws: CISA lists three kernel privilege-escalation bugs as exploited (CVE-2025-39964, CVE-2026-53266 and CVE-2025-39682). These need an attacker to already run code on your system, then let them become root. PwnEscape (CVE-2026-99999), a VM-escape flaw, led cloud hosts to reboot, which is the provider's job.
So a managed host protects you from the kernel bugs only as far as it patches quickly, and it doesn't protect you from PHP2Shell unless its PHP is updated. Ask your host whether it has applied the PHP fix and how it handles kernel patches and reboots. Whatever the host does, keep your own app's packages updated.
Also discussed here:
- Linux - Is it facing any security vulnerabilities currently?
🕒 As of October 2026
