Two critical security vulnerabilities have been announced in PHP, identified as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 in severity.
What does this mean for your website?
PHP is a technology used by millions of websites, including WordPress and other popular applications. These vulnerabilities affect how PHP processes certain data and may, under specific conditions, allow malicious users to perform unauthorized actions.
Appropriate security fixes are therefore required.
What protective measures have we taken?
We have already implemented preliminary protective measures, including security rules at the Web Application Firewall (WAF) level, to help mitigate known attack patterns associated with these vulnerabilities.
We are also monitoring official security announcements and preparing the necessary steps to deploy the available fixes.
What happens next?
The release of official security fixes is underway. As soon as the appropriate updated packages become available for the supported PHP versions in our hosting environment, we will proceed with the necessary updates.
Patch availability depends on the PHP version used by each hosting account.
Do you need to take any action?
No action is required from your side at this time. However, we recommend keeping your website, CMS, and plugins up to date and using a supported PHP version whenever compatible with your application.
We will provide a further update if significant developments occur.
For more information, please refer to the official security update:
https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5
The security of your hosting services is a priority for us, and we continue to monitor the situation closely.
Latest Update - PHP Security Patch Deployment
We have prepared the necessary procedures and automated scripts to deploy the security patches across all servers under our management as soon as the official PHP security updates are released, scheduled for today after 17:00 Greek local time (EEST).
The deployment will cover the following services:
-
cPanel Hosting: Mini Web Hosting, Web Hosting, Business Hosting, and WordPress Hosting
-
Managed Dedicated Servers with cPanel
-
Managed VPS with cPanel or Enhance (WordPress Containers)
The patches will cover all PHP versions, including older versions that have reached End of Life (EOL).
Services Requiring Customer Action
Automatic patch deployment is not included with the following services, where server administration is the customer's responsibility:
-
Unmanaged VPS
-
Dedicated Servers
-
Managed VPS with root access, where we provide reactive technical support upon request rather than proactive server management.
If you use any of these services, you must arrange for the appropriate security patches to be installed.
If you have any questions regarding the updates or your hosting service, please contact the Hostnetics support team.
Final Update - PHP Security Patches Successfully Deployed
CloudLinux has released the patched PHP versions, and we have completed their deployment across the entire Hostnetics hosting infrastructure.
Over the coming hours, we will continue performing checks and security audits to verify that everything is operating as expected. The ModSecurity rules and additional security mitigations will remain in place, providing an extra layer of protection.
No action is required on your part. If you notice any unusual behavior on your website, please contact the Hostnetics support team.
Thank you for your patience and understanding while we awaited the release of the necessary security fixes.
The security of your hosting services remains our priority.
