Working closely with our Hosting Infrastructure partners, the following Critical PHP Vulnerabilities (CVE-2026-109618 / CVE-2026-109619 / CVE-2026-115560) - Resolved.
Two major PHP vulnerabilities were disclosed on October 21 2026 dubbed "PHP2SHELL". The PHP developers released patches for PHP 8.2 through PHP 8.5.
CloudLinux has backported the security fixes to PHP 5.3 through PHP 8.5 and we have updated all servers to use them.
On October 23 2026 an additional vulnerability with ID CVE-2026-115560 was disclosed. There are no updated PHP builds available yet, but there is a mitigation which is to disable "session.upload_progress.enabled" in the server's PHP configurations. We have proactively deployed this to safeguard your sites.
Friday, October 23, 2026
