On 21 October 2026, two critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were reported. These vulnerabilities could potentially allow attackers to execute code on a web server without authentication.
We’re pleased to share that PHP security patching has been completed across our shared Windows hosting environment to address these vulnerabilities. The affected PHP versions have been updated to their respective fixed releases.
Our teams continue to monitor the environment closely to ensure ongoing stability and security. As an additional precaution, temporary security mitigation limits have been applied while we continue working to fully mitigate the risk. These limits may temporarily affect certain file uploads, large form submissions, and backup restores.
If you notice any unusual activity on your website, such as unexpected redirects, unfamiliar administrator accounts or files you did not upload, please contact our support team immediately.
We will share further updates on this page if required. Thank you for your patience, understanding, and continued trust in us as we work to keep your hosting environment secure.
Posted Oct 23, 2026 - 01:29 AEDT
This incident affects: Web Hosting Plesk and Reseller Hosting Plesk.