CloudLinux PHP Security Update – Version Number Clarification for CVE-2026-109618 and CVE-2026-109619
Subscribe
Monitoring - Dear Customer,
We’d like to clarify that some customers may still see PHP version numbers such as 8.2.34, even after the security patching has been completed.
This is expected for servers running CloudLinux. CloudLinux has applied the required security fixes to its existing PHP packages without necessarily changing the version number. As a result, your PHP version may appear older than the fixed versions listed in the official PHP announcements, but the security fix for CVE-2026-109618 and CVE-2026-109619 is already included.
For example, CloudLinux’s PHP 8.2.34 package includes the required security fix, so upgrading specifically to PHP 8.2.35 is not necessary to address these vulnerabilities.
Our teams continue to monitor the environment.
Thank you for your patience and understanding as we continue to keep your hosting environment secure.
Oct 23, 2026 - 18:29 AEDT
We’d like to clarify that some customers may still see PHP version numbers such as 8.2.34, even after the security patching has been completed.
This is expected for servers running CloudLinux. CloudLinux has applied the required security fixes to its existing PHP packages without necessarily changing the version number. As a result, your PHP version may appear older than the fixed versions listed in the official PHP announcements, but the security fix for CVE-2026-109618 and CVE-2026-109619 is already included.
For example, CloudLinux’s PHP 8.2.34 package includes the required security fix, so upgrading specifically to PHP 8.2.35 is not necessary to address these vulnerabilities.
Our teams continue to monitor the environment.
Thank you for your patience and understanding as we continue to keep your hosting environment secure.
Oct 23, 2026 - 18:29 AEDT
Update - On 21 October 2026, two critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were reported. These vulnerabilities could potentially allow attackers to execute code on a web server without authentication.
Our security and infrastructure teams are actively working to address these vulnerabilities across our managed VPS and Dedicated Server environments. We have applied the relevant security updates to servers where patched PHP packages are available.
Security fixes may not be available for some older PHP versions, particularly those that have reached end of life, and updates may not be released for these versions in the future.
What do you need to do?
No immediate action is required if your websites are using latest PHP versions and the server has been updated. If you have concerns about your server's patch status, please contact our support team for assistance.
If you notice unusual activity, such as unexpected redirects, unfamiliar administrator accounts, unknown files, high CPU usage or outbound spam, please contact our support team immediately.
If your websites are running on older PHP versions, we recommend updating your websites to be compatible with the latest supported PHP versions and upgrading the PHP version on your server accordingly.
If you encounter any challenges updating your website or need assistance with the process, please feel free to contact our support team. We’ll be happy to help.
We continue to monitor the situation and will share further updates as more information becomes available.
Thank you for your patience and understanding as we work to keep your hosting environment secure.
Oct 23, 2026 - 03:58 AEDT
Our security and infrastructure teams are actively working to address these vulnerabilities across our managed VPS and Dedicated Server environments. We have applied the relevant security updates to servers where patched PHP packages are available.
Security fixes may not be available for some older PHP versions, particularly those that have reached end of life, and updates may not be released for these versions in the future.
What do you need to do?
No immediate action is required if your websites are using latest PHP versions and the server has been updated. If you have concerns about your server's patch status, please contact our support team for assistance.
If you notice unusual activity, such as unexpected redirects, unfamiliar administrator accounts, unknown files, high CPU usage or outbound spam, please contact our support team immediately.
If your websites are running on older PHP versions, we recommend updating your websites to be compatible with the latest supported PHP versions and upgrading the PHP version on your server accordingly.
If you encounter any challenges updating your website or need assistance with the process, please feel free to contact our support team. We’ll be happy to help.
We continue to monitor the situation and will share further updates as more information becomes available.
Thank you for your patience and understanding as we work to keep your hosting environment secure.
Oct 23, 2026 - 03:58 AEDT
Monitoring - Dear Customers,
We want to let you know that we are closely monitoring the recently identified PHP security vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Please rest assured that your digital security is our top priority.
Our dedicated security and infrastructure teams are already hard at work applying the necessary updates to ensure your server remains fully protected and secure.
We will continue to monitor the situation and take the necessary steps to address these vulnerabilities.
Thank you so much for your trust, patience, and understanding as we work to keep your environment safe.
Oct 22, 2026 - 23:55 AEDT
We want to let you know that we are closely monitoring the recently identified PHP security vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Please rest assured that your digital security is our top priority.
Our dedicated security and infrastructure teams are already hard at work applying the necessary updates to ensure your server remains fully protected and secure.
We will continue to monitor the situation and take the necessary steps to address these vulnerabilities.
Thank you so much for your trust, patience, and understanding as we work to keep your environment safe.
Oct 22, 2026 - 23:55 AEDT
Monitoring - On 21 October 2026, two critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were reported. These vulnerabilities could potentially allow attackers to execute code on a web server without authentication.
We’re pleased to share that PHP security patching has been completed across our shared Windows hosting environment to address these vulnerabilities. The affected PHP versions have been updated to their respective fixed releases.
Our teams continue to monitor the environment closely to ensure ongoing stability and security. As an additional precaution, temporary security mitigation limits have been applied while we continue working to fully mitigate the risk. These limits may temporarily affect certain file uploads, large form submissions, and backup restores.
If you notice any unusual activity on your website, such as unexpected redirects, unfamiliar administrator accounts or files you did not upload, please contact our support team immediately.
We will share further updates on this page if required. Thank you for your patience, understanding, and continued trust in us as we work to keep your hosting environment secure.
Oct 23, 2026 - 01:29 AEDT
We’re pleased to share that PHP security patching has been completed across our shared Windows hosting environment to address these vulnerabilities. The affected PHP versions have been updated to their respective fixed releases.
Our teams continue to monitor the environment closely to ensure ongoing stability and security. As an additional precaution, temporary security mitigation limits have been applied while we continue working to fully mitigate the risk. These limits may temporarily affect certain file uploads, large form submissions, and backup restores.
If you notice any unusual activity on your website, such as unexpected redirects, unfamiliar administrator accounts or files you did not upload, please contact our support team immediately.
We will share further updates on this page if required. Thank you for your patience, understanding, and continued trust in us as we work to keep your hosting environment secure.
Oct 23, 2026 - 01:29 AEDT
Monitoring - On 21 October 2026, two critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were reported. These vulnerabilities could potentially allow attackers to execute code on a web server without authentication.
We’re pleased to share that PHP security patching has been completed across our shared Windows hosting environment to address these vulnerabilities. The affected PHP versions have been updated to their respective fixed releases.
Our teams continue to monitor the environment closely to ensure ongoing stability and security. As an additional precaution, temporary security mitigation limits have been applied while we continue working to fully mitigate the risk. These limits may temporarily affect certain file uploads, large form submissions, and backup restores.
If you notice any unusual activity on your website, such as unexpected redirects, unfamiliar administrator accounts or files you did not upload, please contact our support team immediately.
We will share further updates on this page if required. Thank you for your patience, understanding, and continued trust in us as we work to keep your hosting environment secure.
Oct 23, 2026 - 01:26 AEDT
We’re pleased to share that PHP security patching has been completed across our shared Windows hosting environment to address these vulnerabilities. The affected PHP versions have been updated to their respective fixed releases.
Our teams continue to monitor the environment closely to ensure ongoing stability and security. As an additional precaution, temporary security mitigation limits have been applied while we continue working to fully mitigate the risk. These limits may temporarily affect certain file uploads, large form submissions, and backup restores.
If you notice any unusual activity on your website, such as unexpected redirects, unfamiliar administrator accounts or files you did not upload, please contact our support team immediately.
We will share further updates on this page if required. Thank you for your patience, understanding, and continued trust in us as we work to keep your hosting environment secure.
Oct 23, 2026 - 01:26 AEDT
Identified - Dear Customer,
We’d like to share an update regarding two recently identified critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
Protecting our customers’ websites and data is a priority. As a precaution, our security and infrastructure teams applied temporary security mitigations across our shared hosting servers on 21 October 2026 while the permanent fixes are being prepared.
How might this affect your website?
As part of these temporary security measures, some website functions may experience limitations, particularly:
Uploading larger files, such as images, videos and documents.
Submitting larger forms or importing data.
Restoring backups or performing website migrations.
Installing themes or plugins that require file uploads.
The impact may vary depending on your server and the functionality being used. Smaller uploads and routine website operations may continue to work normally.
What happens next?
Our teams are working with our software providers to deploy the appropriate security updates as soon as they become available. Once the permanent fixes are ready and installed, the temporary restrictions can be reviewed and removed.
We expect this process to take a few days, although the timeframe may vary depending on the PHP version and availability of the required updates. We’ll share further updates as more information becomes available.
We understand that these temporary limitations may cause inconvenience, and we appreciate your patience while we work to address the vulnerabilities. These measures have been implemented as a precaution to help maintain a secure hosting environment.
Thank you for your understanding and for trusting us to host your websites.
Our commitment remains the same: keeping your hosting environment secure while minimising disruption to your services.
Oct 22, 2026 - 00:52 AEDT
We’d like to share an update regarding two recently identified critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
Protecting our customers’ websites and data is a priority. As a precaution, our security and infrastructure teams applied temporary security mitigations across our shared hosting servers on 21 October 2026 while the permanent fixes are being prepared.
How might this affect your website?
As part of these temporary security measures, some website functions may experience limitations, particularly:
Uploading larger files, such as images, videos and documents.
Submitting larger forms or importing data.
Restoring backups or performing website migrations.
Installing themes or plugins that require file uploads.
The impact may vary depending on your server and the functionality being used. Smaller uploads and routine website operations may continue to work normally.
What happens next?
Our teams are working with our software providers to deploy the appropriate security updates as soon as they become available. Once the permanent fixes are ready and installed, the temporary restrictions can be reviewed and removed.
We expect this process to take a few days, although the timeframe may vary depending on the PHP version and availability of the required updates. We’ll share further updates as more information becomes available.
We understand that these temporary limitations may cause inconvenience, and we appreciate your patience while we work to address the vulnerabilities. These measures have been implemented as a precaution to help maintain a secure hosting environment.
Thank you for your understanding and for trusting us to host your websites.
Our commitment remains the same: keeping your hosting environment secure while minimising disruption to your services.
Oct 22, 2026 - 00:52 AEDT
Monitoring - Dear Customers,
We would like to bring to your attention two critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which may affect PHP installations on your servers.
If you are using a self-managed VPS or Dedicated Server, we recommend reviewing your installed PHP version and applying the relevant security updates as advised by your PHP distribution or operating system provider.
What you need to do:
Review the PHP versions installed on your server to determine whether they are affected.
If your installation is affected, apply the appropriate security updates following your operating system, control panel's recommendations.
If you are unsure how to proceed, consult your system administrator or contact our support team for guidance.
Please note: For self-managed VPS and Dedicated Servers, maintaining server software and applying security updates are the customer's responsibility.
We recommend addressing this advisory promptly to help protect your server and hosted websites from potential security risks.
Thank you for your attention and cooperation. Our support team is available to assist with any questions you may have.
Oct 22, 2026 - 15:59 AEDT
We would like to bring to your attention two critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which may affect PHP installations on your servers.
If you are using a self-managed VPS or Dedicated Server, we recommend reviewing your installed PHP version and applying the relevant security updates as advised by your PHP distribution or operating system provider.
What you need to do:
Review the PHP versions installed on your server to determine whether they are affected.
If your installation is affected, apply the appropriate security updates following your operating system, control panel's recommendations.
If you are unsure how to proceed, consult your system administrator or contact our support team for guidance.
Please note: For self-managed VPS and Dedicated Servers, maintaining server software and applying security updates are the customer's responsibility.
We recommend addressing this advisory promptly to help protect your server and hosted websites from potential security risks.
Thank you for your attention and cooperation. Our support team is available to assist with any questions you may have.
Oct 22, 2026 - 15:59 AEDT
About This Site
Welcome to the Web24 status page. This page keeps you up to date with any scheduled or unscheduled maintenance on our network.
Web Hosting Plesk
Operational
Reseller Hosting Plesk
Operational
Web Hosting cPanel
Operational
Reseller Hosting cPanel
Operational
Cloud VPS
Operational
Mission Critical VPS
Operational
VMWare VPS
Operational
Dedicated Servers
Operational
Network
Operational
DNS Cluster
Operational
Web24 Website
Operational
Customer Control Panel Login
Operational
Technical Support (Tickets)
Operational
Technical Support (Phone)
Operational
Email Filtering Cluster
Operational
Web24 Billing Platform
Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance
Major outage
Partial outage
No downtime recorded on this day.
No data exists for this day.
had a major outage.
had a partial outage.