PHP vulnerability advisory notice

We've now resolved the incident. Thanks for your patience.

Please note our provider CloudLinux applies these patches as a backport, retaining the existing version numbers. This causes the displayed version number to appear lower than the official PHP version patched. (for example, ea-php84 is 8.4.26, not 8.4.27)

No further action is required for Web Hosting customers to protect against CVE-2026-109618 and CVE-2026-109619

More information on this is available via the CloudLinux blog here under the "How to confirm the fix" update.

Another method is to use "php -v" within the terminal of your cPanel service which will show the UTC time the build was created which should show an update from today after conversion to AEST.

We are continuing to closely monitor the servers as services fully stabilise.

The necessary security patches have now been applied, and we have removed the additional security measures, including the temporary restrictions on file uploads.

We are continuing to closely monitor the servers as services fully stabilise.

If you experience any issues moving forward, please reach out to our technical support team via eTicket.

CloudLinux has now published all patched PHP versions from 5.2 - 8.5. These are being successfully rolled out to our shared hosting and fully managed servers. The updates are still in progress and will take some time to reach all servers. We will update this status notice when all servers are updated and will remove the file upload mitigation once patched versions are deployed on all servers.

There is no action required from customers. Patched versions of PHP will automatically be applied to all cPanel services already using PHP 5.2 - 8.5.

CloudLinux has begun publishing some patched versions of PHP. We're currently rolling these out and testing. We will update this status with confirmed updates once we complete our testing.

CloudLinux have confirmed patches for PHP versions 5.2 - 8.5. They are currently working on publishing these so that we can deploy them across all shared hosting and fully managed VPS services. We will deploy updates automatically and update this status notice. In the mean time our file upload mitigation is in place to keep websites secure. We expect patches to be published and deployed within the next few hours.

Our vendors are in the process of distributing update packages, and we are applying them as they become available.

CloudLinux has confirmed they will be back-porting security patches for all PHP versions between 5.2, through to 8.5.

Additional mitigations to protect customer websites are in place across our shared hosting and fully managed VPS infrastructure, as per the recommended advice from the PHP Foundation.

We will provide additional updates as updates are available and applied.

The PHP security team have advised of an upcoming critical security release scheduled for Wednesday, October 21, 2026, at 14:00 UTC (Thursday, October 22, 2026, at 1:00 am AEDT). This release covers two critical vulnerabilities, both rated 9.2 out of 10 on the CVSS scale.

Full details have not yet been released regarding the versions impacted or the nature of the vulnerabilities, only their critical nature. More details on the impacted versions and recommended steps will be available as soon as we have more information.

You can see the official PHP team's post here: https://www.php.net/archive/2026.php#2026-10-20-1

Once we have confirmation that a patch has been released, we will be applying it ASAP.