Critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 fixed on all servers...

On October 21, the PHP team disclosed two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both are related to how PHP handles memory while it processes a web request.

If an attacker sent a site a specially crafted request, PHP could get confused about its own internal data. In one case it used data it had not finished preparing yet. In the other, it used data left over from a previous request that should already have been wiped. Under the right conditions, this made it possible to run someone else's code on the server.

That is why both vulnerabilities were given a critical severity rating of CVSS 9.2. The PHP developers told that configuration changes can only reduce the risk, and only an update actually removes it. Example attack code is already publicly available, so the updates must be installed ASAP.

What we did. Our servers are updated continuously, and we keep a close eye on their health and security. The update was installed on all servers as soon as the updated PHP packages came out. Every PHP version you can choose for a site in the hosting control panel received the fix.

What you need to do. Nothing extra. Your sites stay on the same PHP versions you chose for them. No settings were changed, and there is no need to switch to another PHP version right now. That said, we do recommend using the newest PHP versions where possible, once your code is ready for them.

A tip for the future. Vulnerabilities in PHP are found regularly, and we keep the server side updated ourselves. A site is also its CMS, theme and plugins, and those are updated by the site owner (or by the developer who looks after the site and its updates).