Critical PHP vulnerabilities CVE-2026-109618 / CVE-2026-109619 - release 21 October 2026, 16:00 UTC+2
Subscribe
Update - Security Update – Patched PHP Templates Available on JPaaS
We have made updated PHP container templates available on our JPaaS platform to address the security vulnerabilities CVE-2026-109618 and CVE-2026-109619.
The following patched PHP versions are now available:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Action Required: Customers running PHP-based applications on JPaaS (Apache, Nginx, LiteSpeed, etc) must redeploy their containers using one of the updated PHP image tags listed above to apply the security fixes.
Important: Existing running containers are not automatically updated when new templates become available. Customers must explicitly perform a "Redeploy" operation using a patched image tag to ensure their applications are protected.
We strongly recommend completing this action immediately to minimize exposure to these vulnerabilities.
Oct 22, 2026 - 13:34 CEST
We have made updated PHP container templates available on our JPaaS platform to address the security vulnerabilities CVE-2026-109618 and CVE-2026-109619.
The following patched PHP versions are now available:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Action Required: Customers running PHP-based applications on JPaaS (Apache, Nginx, LiteSpeed, etc) must redeploy their containers using one of the updated PHP image tags listed above to apply the security fixes.
Important: Existing running containers are not automatically updated when new templates become available. Customers must explicitly perform a "Redeploy" operation using a patched image tag to ensure their applications are protected.
We strongly recommend completing this action immediately to minimize exposure to these vulnerabilities.
Oct 22, 2026 - 13:34 CEST
Monitoring - Security Update – PHP Vulnerabilities CVE-2026-109618 / CVE-2026-109619
We have deployed the available security patches addressing CVE-2026-109618 and CVE-2026-109619 across our managed hosting infrastructure.
The current patching status for each hosting service is as follows:
Shared Linux Hosting
- All PHP versions have been updated or patched to their respective fixed versions.
Shared Windows Hosting
- PHP versions 8.2, 8.3, 8.4, and 8.5 have been updated to the fixed versions.
- PHP versions earlier than 8.2 will not receive updates.
- Customers using older PHP versions must verify their websites' PHP configurations and switch to a supported, patched PHP version immediately.
Managed Dedicated Servers & VPS
- PHP versions 7.4 through 8.5 have been updated or patched to their respective fixed versions.
- PHP versions earlier than 7.4 will not receive updates (except for CloudLinux servers).
- Customers using older PHP versions must verify their websites' PHP configurations and switch to a supported, patched PHP version immediately.
Unmanaged Dedicated Servers & VPS
- Customers are responsible for maintaining and updating their server environments.
- We strongly urge all customers to check their installed PHP versions and apply the available security updates immediately.
Important: Customers running outdated or unsupported PHP versions should upgrade to a supported, patched version without delay to protect their websites and applications against potential exploitation.
We will continue monitoring the situation and taking appropriate measures to maintain the security of our hosting infrastructure.
Oct 22, 2026 - 11:30 CEST
We have deployed the available security patches addressing CVE-2026-109618 and CVE-2026-109619 across our managed hosting infrastructure.
The current patching status for each hosting service is as follows:
Shared Linux Hosting
- All PHP versions have been updated or patched to their respective fixed versions.
Shared Windows Hosting
- PHP versions 8.2, 8.3, 8.4, and 8.5 have been updated to the fixed versions.
- PHP versions earlier than 8.2 will not receive updates.
- Customers using older PHP versions must verify their websites' PHP configurations and switch to a supported, patched PHP version immediately.
Managed Dedicated Servers & VPS
- PHP versions 7.4 through 8.5 have been updated or patched to their respective fixed versions.
- PHP versions earlier than 7.4 will not receive updates (except for CloudLinux servers).
- Customers using older PHP versions must verify their websites' PHP configurations and switch to a supported, patched PHP version immediately.
Unmanaged Dedicated Servers & VPS
- Customers are responsible for maintaining and updating their server environments.
- We strongly urge all customers to check their installed PHP versions and apply the available security updates immediately.
Important: Customers running outdated or unsupported PHP versions should upgrade to a supported, patched version without delay to protect their websites and applications against potential exploitation.
We will continue monitoring the situation and taking appropriate measures to maintain the security of our hosting infrastructure.
Oct 22, 2026 - 11:30 CEST
Update - PHP updates are out
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
- PHP security advisory - https://www.php.net/archive/2026.php#2026-10-21-5
- PHP downloads - https://www.php.net/downloads.php
- Advisories: CVE-2026-109618 https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w and CVE-2026-109619https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)
cPanel is releasing updates with partial backporting. The updated packages are 8.5.12, 8.4.27, 8.3.36, 8.2.35, along with the backported versions 8.1.34,8.0.30, and 7.4.33
CloudLinux packages are not released yet.
If you rely on the volunteer-maintained rpms.remirepo.net, PHP says it will not have updates today and urges switching to distribution packages or building from source.
Oct 21, 2026 - 16:38 CEST
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
- PHP security advisory - https://www.php.net/archive/2026.php#2026-10-21-5
- PHP downloads - https://www.php.net/downloads.php
- Advisories: CVE-2026-109618 https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w and CVE-2026-109619https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)
cPanel is releasing updates with partial backporting. The updated packages are 8.5.12, 8.4.27, 8.3.36, 8.2.35, along with the backported versions 8.1.34,8.0.30, and 7.4.33
CloudLinux packages are not released yet.
If you rely on the volunteer-maintained rpms.remirepo.net, PHP says it will not have updates today and urges switching to distribution packages or building from source.
Oct 21, 2026 - 16:38 CEST
Identified - We have proactively deployed a ModSecurity blocking rule to mitigate the publicly circulating exploit pattern associated with CVE-2026-109618 and CVE-2026-109619, targeting PHP's session upload progress handling in multipart HTTP requests.
This mitigation has been rolled out across our Shared Hosting, Managed Dedicated Servers, and Managed VPS environments as an additional layer of protection.
Important: This mitigation is a temporary protective measure and does not constitute a complete fix for the underlying vulnerabilities. It does not replace the need to upgrade PHP to the patched versions as soon as they become available.
We are closely monitoring the situation and will continue taking the necessary steps to protect our hosting infrastructure and customers.
Oct 21, 2026 - 15:36 CEST
This mitigation has been rolled out across our Shared Hosting, Managed Dedicated Servers, and Managed VPS environments as an additional layer of protection.
Important: This mitigation is a temporary protective measure and does not constitute a complete fix for the underlying vulnerabilities. It does not replace the need to upgrade PHP to the patched versions as soon as they become available.
We are closely monitoring the situation and will continue taking the necessary steps to protect our hosting infrastructure and customers.
Oct 21, 2026 - 15:36 CEST
Investigating - The PHP Security Team has announced an upcoming security release scheduled for Wednesday, 21 October 2026 at 16:00 UTC+2.
It addresses two critical vulnerabilities, publicly reported as CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 (Critical).
Technical details and affected versions are scheduled to be disclosed at that time.
We will post updates here as more information becomes available.
Official announcement:
https://www.php.net/archive/2026.php#2026-10-20-1
Oct 21, 2026 - 11:45 CEST
It addresses two critical vulnerabilities, publicly reported as CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 (Critical).
Technical details and affected versions are scheduled to be disclosed at that time.
We will post updates here as more information becomes available.
Official announcement:
https://www.php.net/archive/2026.php#2026-10-20-1
Oct 21, 2026 - 11:45 CEST
About This Site
This page provides real-time updates on the status of Libyan Spider's services, including incidents, maintenance, and system performance. Stay informed about any disruptions or planned updates. For further assistance, contact our support team.
Core Services
Operational
Clients Portal
Operational
Help Desk
Operational
LibyanSpider.com
Operational
DNS Services
Operational
Phone System
Operational
Domains & Registrar Services
Operational
Domain Search & Availability
Operational
Domain Registration & Renewal
Operational
Nameserver Updates (Delegation)
Operational
Registry Connectivity (EPP / Gateway)
Operational
Network
Operational
Tripoli
Operational
Falkenstein
Operational
Helsinki
Operational
Amsterdam
Operational
Frankfurt
Operational
Dedicated Servers
Operational
Tripoli
Operational
Falkenstein
Operational
Helsinki
Operational
Cloud Virtual Private Servers
Operational
Tripoli
Operational
Falkenstein
Operational
Helsinki
Operational
Web Hosting Services
Operational
Tripoli Data Center
Operational
Falkenstein Data Center
Operational
Helsinki Data Center
Operational
APIs
Operational
Domains Reseller API
Operational
Plutus API
Operational
JPaaS
Operational
JPaaS Clients Dashboard
Operational
JPaaS Core Services
Operational
LS Cloud
Operational
LS Cloud Clients Portal
Operational
LS Cloud API
Operational
LS Cloud Core Services
Operational
Cloudflare
Operational
Cloudflare Zone Versioning
Operational
Cloudflare API
Operational
Cloudflare CDN Cache Purge
Operational
Cloudflare CDN/Cache
Operational
Cloudflare Dashboard
Operational
Cloudflare DNS Root Servers
Operational
Cloudflare DNS Updates
Operational
Cloudflare Firewall
Operational
Cloudflare Gateway
Operational
Cloudflare Health Checks
Operational
Cloudflare Infrastructure
Operational
Cloudflare Load Balancing and Monitoring
Operational
Cloudflare Logs
Operational
Cloudflare Network
Operational
Cloudflare Page Shield
Operational
Cloudflare Recursive DNS
Operational
Cloudflare Rules
Operational
Cloudflare Security Center
Operational
Cloudflare Speed Optimizations
Operational
Cloudflare SSL for SaaS Provisioning
Operational
Cloudflare SSL Certificate Provisioning
Operational
Cloudflare Support Site
Operational
Cloudflare Tunnel
Operational
Cloudflare User Profiles
Operational
Cloudflare Turnstile
Operational
Cloudflare Waiting Room
Operational
Cloudflare WARP
Operational
Cloudflare Workers
Operational
Cloudflare Workers Preview
Operational
Cloudflare Zero Trust Dashboard
Operational
Cloudflare Zero Trust
Operational
Cloudflare Zaraz
Operational
Cloudflare WebSockets
Operational
Cloudflare Web Analytics
Operational
Cloudflare Radar
Operational
Cloudflare Pages
Operational
LS Suite
Operational
LS Suite Health
Operational
Webmail
Operational
SMTP
Operational
MX01
Operational
MX02
Operational
IMAP
Operational
POP
Operational
Email Delivery
Operational
Control Panel
Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance