We’d like to clarify that some customers may still see PHP version numbers such as 8.2.34, even after the security patching has been completed.
This is expected for servers running CloudLinux. CloudLinux has applied the required security fixes to its existing PHP packages without necessarily changing the version number. As a result, your PHP version may appear older than the fixed versions listed in the official PHP announcements, but the security fix for CVE-2026-109618 and CVE-2026-109619 is already included.
For example, CloudLinux’s PHP 8.2.34 package includes the required security fix, so upgrading specifically to PHP 8.2.35 is not necessary to address these vulnerabilities.
Our teams continue to monitor the environment.
Thank you for your patience and understanding as we continue to keep your hosting environment secure.
Posted Oct 23, 2026 - 18:29 AEDT
This incident affects: Cloud VPS, Mission Critical VPS, VMWare VPS, and Dedicated Servers.