Overview
On October 21, 2026, the PHP development team released urgent security updates addressing two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. PHP powers websites and applications across the internet, making these updates important for organizations running affected versions.
What are the vulnerabilities?
Both issues can allow unauthenticated remote code execution on vulnerable PHP installations. In practical terms, successful exploitation could let an attacker execute malicious instructions on an affected server.
The disclosure does not mean that every PHP website has been compromised. It does mean that administrators of affected PHP installations should apply the appropriate security updates promptly.
How we responded
Following the advisory, our engineering team reviewed the PHP runtime on our managed web server and updated it to the security-patched PHP 8.4.27 release.
On October 22, 2026, we verified that:
- The patched PHP version was installed successfully.
- The PHP processing service was active.
- PHP-FPM configuration validation completed successfully.
- Web server configuration syntax validation completed successfully.
These checks confirm that our managed PHP runtime received the security update addressing the two disclosed vulnerabilities.
What this means for our customers
The PHP security update has been applied to our managed hosting environment, covering customer websites that use this PHP runtime and addressing the identified vulnerabilities.
No action is required from our customers for this update. We manage the underlying infrastructure, including security patches and routine maintenance, as part of our fully managed hosting service.
Our continuing commitment
Reliable hosting involves more than keeping a website online. It requires attention to security advisories, timely infrastructure maintenance, and clear communication when important issues arise. We remain committed to these responsibilities as we support our customers.
