Critical PHP Vulnerabilities

Two critical vulnerabilities have been discovered in PHP — CVE-2026-109618 and CVE-2026-109619 — which could allow attackers to execute arbitrary code on a server without authentication.

On our shared hosting servers, we have disabled the potentially dangerous PHP directives across all PHP versions, significantly reducing the risk of exploitation. We are currently compiling patched PHP versions on all servers, and this process is expected to be completed within the next few hours.

VPS users must update PHP manually.

For outdated PHP 5.x versions, no security updates will be released by the developers. Therefore, these PHP versions will continue to operate with the potentially dangerous directives disabled. We strongly recommend upgrading from PHP 5.x to PHP 8.x.

If you have any questions, please contact our support team.