The PHP project has released a security update for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both allow an attacker to run code on a server without any login or credentials. The affected range is wide — versions as low as PHP 5.
If you are on our managed service, we will update PHP for you as soon as possible.
Where it takes more than an update
PHP 5.x and 7.x are end-of-life and will not receive a fix for these vulnerabilities. A site on one of those branches cannot simply be patched — it has to move to PHP 8.2 or later.
- Home
-
Services
- VirtueMail V2 Email Hosting
- AiFastUp - A Dedicated Secure Web Server
- AiMG Dedicated Email - Guarded by AI
- Web Hosting | AI Website Builder
- PortWatch
- Cloud-Based Spam Filtering
- Imunify360 & CloudLinux Bundles
- Barracuda Advanced Email Security
- Proofpoint Essentials for Email Security
- SSL Marketplace
- SEO & AISEO
- Announcements
- HelpDesk
- About Us
- Contact Us
- Policies
- Blog
