Dear customers,
Two critical vulnerabilities in PHP were disclosed today: CVE-2026-109618 and CVE-2026-109619. You may find more information about the vulnerability at https://www.php.net/archive/2026.php#2026-10-21-5
What happened?
Security researchers found two vulnerabilities that include memory disclosure and unauthenticated remote code execution in PHP itself, independent of the application running on top of it, putting every affected website in immediate risk.
Affected Services: Websites, frameworks, plugins or any applications running PHP (all versions) on all platforms (shared, reseller and VPS/dedicated servers).
Current Status:
If you host your website with us, we have taken care of this for you:
Do I need to do anything?
No action is needed. Your website continues to run normally.
Recommended
If your website or application still uses an older PHP version (8.1 or below), we recommend moving to PHP 8.2 or newer version. You can change this through the MultiPHP Manager in cPanel
In the meantime, customers are advised to keep their CMS, themes, plugins, and other applications up to date and regularly monitor their websites for any unusual activity. If you manage your VPS or dedicated server, please update PHP now to the fixed version.
Thank you for your patience and understanding.
Kind Regards,
Nescom Team
