resolvedOct 23 · 12:05 UTC
Dear customers,
Please note that two PHP security vulnerabilities, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), have recently been disclosed. You may find more information about the vulnerability at https://www.php.net/archive/2026.php#2026-10-20-1
Affected Services: Websites and applications running PHP (all versions) on all platforms.
Current Status:
Mitigation measures have been put in place across all our platforms to reduce the risk of exploitation.
An official fix from the PHP project has not yet been released.
Once the official fix becomes available, we will apply it across our platform.
In the meantime, customers are advised to keep their CMS, themes, plugins, and other applications up to date and regularly monitor their websites for any unusual activity.
Thank you for your patience and understanding. We will update this status post as soon as more information becomes available.
Update @ 09:40 AM EDT | 01:40 UTC, October 21
The php.net team has released the updated versions. Our team is installing them across our platform. We’ll update you once it’s done. If you manage your VPS or dedicated server, please update PHP now to the fixed version.
Update @ 12:50 PM EDT | 4:50 UTC, October 21
All public services affected by those vulnerabilities are mitigated; final patches are in progress. We appreciate your patience!
Update @ 4:40 PM EDT | 8:40 UTC, October 21
We are glad to let you know that the newly patched versions are now available in the CloudLinux staging repositories; we are deploying them to a focus group of servers. Your patience would be highly appreciated!
Update @ October 21, 11:10 PM EDT | October 22, 3:10 UTC
We apologize for the delay in the resolution, our team is still working on deploying the latest versions to the servers. Please stay tuned and thank you for your patience.
Update @ 1:18 AM EDT | 5:18 UTC, October 22
We are happy to let you know that the deployment of the latest versions to the servers is almost over, our team is working as hard as possible to finalize the fix of the issue in the shortest terms. We will update you once it is over. Thank you for your patience!
Update @ 2:41 AM EDT | 6:41 UTC, October 22
While our team is proactively working on the fix deployment, we wanted to update you with the list of the servers that are still in progress:
Reseller: 11, 14, 38, 40, 48-49, 52, 55, 62, 71, 74
Regular: 39, 64, 71-72, 86, 105, 125, 144, 146, 165, 188, 197, 230, 232, 239, 251, 254, 258-259, 261, 263-264, 305-306, 310, 312-313, 315, 319-321, 325-327.
All other servers are already processed. We will update you once the servers mentioned above are processed as well.
Update @ 6:00 AM EDT | 10:00 UTC, October 22
The implementation process is still ongoing. Here is the list of servers where fixes are still being implemented:
Reseller: 48, 55, 71;
Regular: 71 – 72, 86, 105, 165, 188, 259, 264, 306, 310, 312, 315, 320, 326.
The fix was already implemented on other servers. We will update you once we have news.
Update @ 6:27 AM EDT | 10:27 UTC, October 22
The list has been updated to reflect the current status of fix implementation on the servers:
Reseller: 48, 55;
Regular: 71 – 72, 86, 105, 165, 310, 312, 320.
Update @ 7:58 AM EDT | 11:58 UTC, October 22
Servers where fixes are still in progress:
Regular: 71 – 72, 86, 105, 312
The fix has been successfully implemented on all other servers. We will update this status post as soon as we have any further updates.
Thank you for your understanding!
Update @ 9:33 AM EDT | 13:33 UTC, October 22
Servers where fix is still in progress:
Regular: 71, 72, 105, 312
The fix has been successfully implemented on all other servers. We will update this status post as soon as we have any further updates.
Update @ 12:00 PM EDT | 16:00 UTC, October 22
Servers where fix is still in progress:
Regular: 71, 105, 312
The fix has been successfully implemented on all other servers. We will update this status post as soon as we have any further updates.
Update @ 12:50 PM EDT | 16:50 UTC
We are glad to inform you that the maintenance have finished.
Many thanks for your patience.
Update @ 7:00 PM EDT | 00:00 UTC
We installed the security fixes on all Shared Hosting servers as soon as CloudLinux released them. CloudLinux issued its first patches urgently, and those packages did not update the PHP version numbers. Because of this, some PHP versions may have looked unpatched even though the fixes were already in place.
CloudLinux has since released updated packages with the correct version numbers, and we have installed them on all Shared Hosting servers.
The official patched version numbers are now displayed for PHP 8.2-8.5:
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35
For older PHP versions (5.2-8.1), the version numbers stay the same, but the security fixes have been applied to them as well.
All PHP versions offered on our Shared Hosting servers are patched against these vulnerabilities.
