On 21 October (UTC), the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2). They can allow an attacker to run code on a vulnerable web server remotely, without logging in.

Shared and reseller hosting: patched
Our team updated all shared and reseller hosting servers overnight. Sites running PHP 7.4 or later are protected and you don’t need to do anything.

Running a site on PHP older than 7.4?
PHP 7.3 and earlier won’t get a fix for these vulnerabilities. If you have legacy scripts or sites on an older version (or even on PHP 7.4), please migrate them to a supported version as soon as possible. We recommend PHP 8.4. You can change a site’s PHP version in cPanel. Check that your site still works after switching. If you need a hand, our support team can help.

Virtual, cloud, and dedicated server customers: please check your server
If you manage your own server, it’s up to you to keep PHP up to date. Please update PHP as soon as possible and restart PHP-FPM and your web server afterwards. Make sure you’re running these versions or later: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On cPanel servers, the patched EasyApache packages are also available for PHP 7.4, 8.0 and 8.1.

More information can be found at https://www.php.net/archive/2026.php#2026-10-21-5

If you’d like us to update your server for you, or aren’t sure whether you’re affected, contact our team and we’ll do our best to help.