On 21 October, the PHP project released emergency security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale. The flaws affect PHP itself rather than any individual application, and allow remote code execution without authentication. Exploitation was observed in the wild before the patches were published.

What we did

We began responding the same day. Our hosting infrastructure has been updated to patched PHP releases, and affected services were restarted to ensure no unpatched processes remained in memory. Where the upstream fix was not immediately available through our vendors, we built and deployed patched versions ourselves.

The work was not limited to web hosting. We reviewed every system across our infrastructure that runs PHP, including internal and client-facing applications, and updated or patched each one.

We also took the opportunity to complete a planned migration to a new hosting platform with stronger per-site isolation, which limits the impact any single compromised site can have on others sharing the same server.

Alongside the migration we retired the PHP versions we could no longer keep secure, and all remaining versions – including PHP 7.4, 8.0 and 8.1, for which our platform vendor backported the official fixes – are running patched builds.

What this means for you

No action is required. Your sites and data were not affected by the migration, and patched PHP versions are now in place. If your website runs on PHP 8.1 or older – these versions are patched against these specific vulnerabilities but no longer receive general security support from the PHP project. Please consider moving your applications to a supported release.

Questions

If you have any concerns about this issue or your site’s configuration, contact our support team and we’ll be happy to help.