Important PHP Security Advisory (October 2026)
What Website Owners Need to Know
Last updated: 22 October 2026
Please keep an eye on our status page for regular updates.
On 21 October 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities:
- CVE-2026-109618
- CVE-2026-109619
Both vulnerabilities were rated 9.2 out of 10 in severity and could potentially allow attackers to execute malicious code on affected systems.
These are industry-wide vulnerabilities affecting PHP itself, rather than an issue specific to our hosting services.
Our Systems and Development teams have been working extensively to apply the necessary security updates across our hosting infrastructure.
Do I need to do anything?
If you’re using our shared or reseller hosting services, no action is required from you to address these particular PHP vulnerabilities.
We’ve applied the relevant security updates at server level, including fixes for older PHP versions provided through CloudLinux.
You do not need to change your PHP version specifically because of this security announcement.
For other hosting services, the situation depends on the platform and PHP version you’re using. We’ve explained the differences below.
What have we done?
Our teams worked throughout the evening of 21 October and overnight to apply security patches and additional protections across our hosting platforms.
Shared hosting, reseller hosting and managed cPanel/Plesk servers
The relevant PHP security updates have been applied across our cPanel, Plesk and DirectAdmin infrastructure.
CloudLinux has also provided backported security fixes for older PHP versions, covering PHP 5.2 through to 8.5 through its PHP Selector.
This means customers running older PHP versions, such as PHP 5.6, 7.2 or 7.4, are covered against these particular vulnerabilities when using the patched CloudLinux packages.
No PHP version change is required to address these vulnerabilities on our patched shared hosting services.
Although we generally recommend using newer, supported PHP versions for long-term security and compatibility, there is no need to rush into changing an existing, working website because of this announcement.
Scout, JCP and ULTRA Cloud
Security updates have been applied to PHP versions 7.4 through to 8.5 across our updated Scout, JCP and ULTRA Cloud platform.
Customers running these patched versions do not need to change their PHP version specifically because of these vulnerabilities.
Some older PHP versions and legacy server environments have not received the latest patches.
For JCP customers, we’ve introduced a new PHP column to help identify which PHP versions your websites are using.
Any PHP versions highlighted in red have not received the necessary security patches and require attention.
We recommend reviewing these websites and planning an upgrade to a patched PHP version.
Temporary security measures have been applied where possible, and we’re contacting affected customers directly where further action is required.
Windows servers
For Windows servers maintained by our team, PHP versions 8.2 through to 8.5 have received the relevant updates.
Older versions may currently be covered by temporary mitigations only, and we’re contacting affected customers where appropriate.
If you operate an unmanaged Windows server or another customer-managed server, you’ll need to check and apply the appropriate PHP security updates yourself.
Why does my website still show an older PHP version number?
Some customers have noticed that WordPress, phpinfo() or their hosting control panel still reports a PHP version older than the official fixed release.
For example, a website might report PHP 8.2.34 rather than PHP 8.2.35.
This does not necessarily mean the website is vulnerable.
CloudLinux uses a process called backporting, which allows security fixes to be applied to existing PHP packages without changing the version number displayed by your website.
This means an older version number can still contain the relevant security fixes.
Our teams can verify the installed packages if there are concerns about a particular server or PHP installation.
Should I upgrade my PHP version?
We always recommend using a currently supported PHP version wherever possible.
Older versions such as PHP 5.6, 7.2 and 7.4 are no longer supported directly by the PHP development team.
Although CloudLinux provides additional security maintenance for older versions, moving to a newer PHP release remains worthwhile for long-term security, performance and compatibility.
However, there is no need to make an urgent PHP version change on our patched shared hosting services specifically because of these two vulnerabilities.
Changing PHP versions can sometimes cause problems with older websites, plugins or applications.
If you’re planning an upgrade, we’d recommend:
- Taking a full backup of your website and database.
- Checking that your website software supports the newer PHP version.
- Updating WordPress, plugins and themes where applicable.
- Testing the website thoroughly after making changes.
Where possible, major PHP upgrades should be tested on a staging website before applying them to the live site.
How can I check which PHP version my website is using?
cPanel
- Log in to cPanel.
- Search for Select PHP Version.
- Open the PHP Selector to view your current PHP version.
If you manage multiple websites through WHM, you can navigate to List Accounts, access each account’s cPanel and check its PHP version.
WordPress
You can normally check your PHP version under:
WordPress Dashboard > Tools > Site Health > Info > Server
Please remember that the version displayed may not reflect security fixes backported by your hosting provider.
What other security precautions have been taken?
In addition to applying PHP updates, we’ve introduced additional protections where appropriate.
These include updated Imunify360 firewall rules and temporary PHP configuration changes to help reduce exposure to the vulnerabilities.
Some older environments that cannot receive the latest security patches remain protected by temporary, best-effort mitigations.
These additional measures are not a guaranteed replacement for installing the appropriate PHP security updates.
What else should I do to keep my website secure?
Although we’ve addressed these particular PHP vulnerabilities across our patched hosting environments, this doesn’t guarantee that an individual website is free from other security issues.
We recommend that website owners continue to:
- Keep WordPress, plugins, themes and other website software updated.
- Remove unused or abandoned plugins and themes.
- Use strong passwords and enable two-factor authentication where available.
- Maintain recent, working backups.
- Review older PHP versions and plan upgrades when appropriate.
- Investigate unexpected website changes or suspicious behaviour.
For customers using unmanaged website services, maintaining the website’s application software remains the customer’s responsibility.
Please note that updating WordPress or its plugins alone does not fix a vulnerability within PHP itself.
What if I manage my own server?
Customers managing their own servers or PHP installations should not assume that security updates have been applied automatically.
Please check your installed PHP packages and ensure they contain the relevant fixes for CVE-2026-109618 and CVE-2026-109619.
Where appropriate updates are not yet available, we recommend discussing upgrade options and temporary security measures with your server administrator.
Further information
For further technical information, please see:
We’ll continue monitoring developments and updating this article where necessary.
If you have concerns about a particular website or hosting service, please contact our Support team.