News

On October 21, 2026, the PHP development team published a security advisory for two critical vulnerabilities that can allow unauthenticated remote code execution on PHP installations serving web requests:

• CVE-2026-109618: remote code execution through a memory-exhaustion error during request handling
• CVE-2026-109619: remote code execution through internal data from a previous request being reused by the next one

Our system administrators have already applied the security updates (patches) on all servers for the following PHP versions: 5.6, 7.1, 7.2, 7.3, 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, and 8.5. The fix is active at the server level, so no user action is required for these versions, and existing websites and applications are not affected by the change.

If you are running an obsolete PHP version, now is the time to update your application and switch to a modern PHP version. We recommend PHP 8.3 or newer. Obsolete versions no longer receive security fixes from the PHP project, so any future vulnerability of this kind may remain unpatched indefinitely. 

You can check and change the PHP version used by your websites from the PHP Settings section of the hosting Control Panel.

For full technical details, please refer to the official PHP security advisory.