The PHP security team has announced that they will release fixes for two critical vulnerabilities, both rated 9.2 out of 10 (CVSS v4.0), on Wednesday 21 October 2026 at 14:00 UTC (3pm UK time).
Details of the vulnerabilities are currently under embargo. When the patches are released we will work to apply them to our fleet as quickly as possible. The vulnerabilities have been assigned CVE-2026-109618 and CVE-2026-109619.
The PHP team have indicated that versions that are out of support will not receive patches. This includes all versions below 8.2.
What we’re doing
We’ll update PHP on our servers as soon as fixed packages are published:
- cPanel servers: we’ll install cPanel’s updated PHP packages as soon as cPanel releases them.
- Prostack Cito servers: we’ll roll out the updated PHP packages to every Cito server as soon as they’re available.
These updates do not incur downtime.
If the details allow it, we’ll also add a rule to our web application firewall to block attacks while the updates roll out. Whether or not this is possible is dependent on the exact nature of the vulnerabilities, which is not yet known.
What you need to do
If your site runs PHP 8.2 or newer, you don’t need to do anything. We’ll apply the update for you.
If your site runs PHP 8.1 or older, you should update it now. These versions are end-of-life, which means they do not receive any security patches or upgrades.
You should:
- Check your site works on a newer PHP version, especially its plugins and themes. These are often prone to breakage between PHP versions.
- Change the version in your control panel. In cPanel, use MultiPHP Manager. In Cito, this can be changed in Site Settings.
- If you’re unsure how to do this, contact our support team. We can’t update your site for you, but we can offer advice on how to proceed.
What happens next
We’ll update this post once the fixes are released, with the affected versions and status of our rollout. If you have questions in the meantime, contact our support team.
