We are writing to advise customers that our servers have been fully patched against two critical security vulnerabilities recently disclosed in the PHP interpreter.
Affected Vulnerabilities
- CVE-2026-109618
- CVE-2026-109619
Both issues are rated as high severity and could allow remote code execution under certain conditions. They affect a wide range of PHP versions used in production web environments.
Remediation Status
Updated packages addressing both vulnerabilities were released early on 22 October 2026. Our infrastructure runs CloudLinux, which has backported the fixes across its supported PHP versions. As a result, all PHP versions currently available on our platform — from 5.2 through to 8.5 — have received the security updates.
No further action is required from customers at this time. The patches have been applied at the server level, and existing sites continue to run on their previously selected PHP versions with the security fixes in place.
We will continue to monitor the situation and apply any additional updates as they become available. If you have questions about your specific account or PHP version, please contact our support team.