Security Update – Patched PHP Templates Available on JPaaS
We have made updated PHP container templates available on our JPaaS platform to address the security vulnerabilities CVE-2026-109618 and CVE-2026-109619.
The following patched PHP versions are now available: - PHP 8.5.12 - PHP 8.4.27 - PHP 8.3.36 - PHP 8.2.35
Action Required: Customers running PHP-based applications on JPaaS (Apache, Nginx, LiteSpeed, etc) must redeploy their containers using one of the updated PHP image tags listed above to apply the security fixes.
Important: Existing running containers are not automatically updated when new templates become available. Customers must explicitly perform a "Redeploy" operation using a patched image tag to ensure their applications are protected.
We strongly recommend completing this action immediately to minimize exposure to these vulnerabilities.
We have deployed the available security patches addressing CVE-2026-109618 and CVE-2026-109619 across our managed hosting infrastructure.
The current patching status for each hosting service is as follows:
Shared Linux Hosting - All PHP versions have been updated or patched to their respective fixed versions.
Shared Windows Hosting - PHP versions 8.2, 8.3, 8.4, and 8.5 have been updated to the fixed versions. - PHP versions earlier than 8.2 will not receive updates. - Customers using older PHP versions must verify their websites' PHP configurations and switch to a supported, patched PHP version immediately.
Managed Dedicated Servers & VPS - PHP versions 7.4 through 8.5 have been updated or patched to their respective fixed versions. - PHP versions earlier than 7.4 will not receive updates (except for CloudLinux servers). - Customers using older PHP versions must verify their websites' PHP configurations and switch to a supported, patched PHP version immediately.
Unmanaged Dedicated Servers & VPS - Customers are responsible for maintaining and updating their server environments. - We strongly urge all customers to check their installed PHP versions and apply the available security updates immediately.
Important: Customers running outdated or unsupported PHP versions should upgrade to a supported, patched version without delay to protect their websites and applications against potential exploitation.
We will continue monitoring the situation and taking appropriate measures to maintain the security of our hosting infrastructure.
cPanel is releasing updates with partial backporting. The updated packages are 8.5.12, 8.4.27, 8.3.36, 8.2.35, along with the backported versions 8.1.34,8.0.30, and 7.4.33
CloudLinux packages are not released yet.
If you rely on the volunteer-maintained rpms.remirepo.net, PHP says it will not have updates today and urges switching to distribution packages or building from source.
Posted Oct 21, 2026 - 16:38 CEST
Identified
We have proactively deployed a ModSecurity blocking rule to mitigate the publicly circulating exploit pattern associated with CVE-2026-109618 and CVE-2026-109619, targeting PHP's session upload progress handling in multipart HTTP requests.
This mitigation has been rolled out across our Shared Hosting, Managed Dedicated Servers, and Managed VPS environments as an additional layer of protection.
Important: This mitigation is a temporary protective measure and does not constitute a complete fix for the underlying vulnerabilities. It does not replace the need to upgrade PHP to the patched versions as soon as they become available.
We are closely monitoring the situation and will continue taking the necessary steps to protect our hosting infrastructure and customers.
Posted Oct 21, 2026 - 15:36 CEST
Investigating
The PHP Security Team has announced an upcoming security release scheduled for Wednesday, 21 October 2026 at 16:00 UTC+2. It addresses two critical vulnerabilities, publicly reported as CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 (Critical). Technical details and affected versions are scheduled to be disclosed at that time.
We will post updates here as more information becomes available.