Critical PHP Security Update
Updated: 22 October 2022, at 14:30
On 21 October 2026, two critical security vulnerabilities were disclosed in PHP, the software used to power WordPress and many other websites.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could potentially allow an attacker to execute unauthorised code on affected servers.
These vulnerabilities affected PHP installations worldwide, and updates were issued by PHP, cPanel and CloudLinux.
Our response
We have been working closely with our hosting infrastructure provider to ensure the necessary security updates were applied as soon as they became available.
CloudLinux released its updated PHP packages overnight on 21–22 October 2026.
As of 22 October, our hosting provider has confirmed that the relevant security patches have been installed and verified across the PHP packages on our server.
This verification included checking the installed software packages against both published vulnerabilities.
Why some websites may still report an older PHP version
Some external security scanners may continue to identify PHP versions such as 8.3.35 or 8.4.26.
This is expected with CloudLinux, which applies security fixes directly to its existing PHP packages, a process known as backporting.
As a result, the reported PHP version may remain unchanged even though the relevant security fixes have been installed.
Our hosting provider has verified the installed patches directly rather than relying solely on the reported version numbers.
Do clients need to do anything?
No action is required from clients in relation to these PHP security updates.
The updates have been handled at server level as part of our managed hosting service.
We continue to work with our infrastructure provider to maintain the security and reliability of the websites we host.
Further information
For technical details and confirmation of the patches, please refer to the official advisories:
- CloudLinux – PHP security vulnerabilities and patch verification
- cPanel – Critical PHP Security Release
If you have any questions about your website or its security, please contact Control X Digital.
