Dear Customers,
On 21 October 2026, two critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were reported. These vulnerabilities could potentially allow attackers to execute code on a web server without authentication.
Our security and infrastructure teams are actively working to address these vulnerabilities across our managed VPS and Dedicated Server environments. We have applied the relevant security updates to servers where patched PHP packages are available.
Security fixes may not be available for some older PHP versions, particularly those that have reached end of life, and updates may not be released for these versions in the future.
What do you need to do?
No immediate action is required if your websites are using latest PHP versions and the server has been updated. If you have concerns about your server's patch status, please contact our support team for assistance.
If you notice unusual activity, such as unexpected redirects, unfamiliar administrator accounts, unknown files, high CPU usage or outbound spam, please contact our support team immediately.
If your websites are running on older PHP versions, we recommend updating your websites to be compatible with the latest supported PHP versions and upgrading the PHP version on your server accordingly.
If you encounter any challenges updating your website or need assistance with the process, please feel free to contact our support team. We’ll be happy to help.
We continue to monitor the situation and will share further updates as more information becomes available.
Thank you for your patience and understanding as we work to keep your hosting environment secure.