Digital Pacific incident
CloudLinux PHP Security Update – Version Number Clarification for CVE-2026-109618 and CVE-2026-109619
Ongoing since 07:28 AM UTC, affecting Dedicated Servers and VPS Hosting.
Dear Customer, We’d like to clarify that some customers may still see PHP version numbers such as 8.2.34, even after the security patching has been completed. This is expected for servers running CloudLinux. CloudLinux has applied the required security fixes to its existing PHP packages without necessarily changing the version number. As a result, your PHP version may appear older than the fixed versions listed in the official PHP announcements, but the security fix for CVE-2026-109618 and CVE-2026-109619 is already included. For example, CloudLinux’s PHP 8.2.34 package includes the required security fix, so upgrading specifically to PHP 8.2.35 is not necessary to address these vulnerabilities. Our teams continue to monitor the environment. Thank you for your patience and understanding as we continue to keep your hosting environment secure.
Affected components
Update timeline
- monitoring Oct 23, 2026, 07:28 AM UTC
Dear Customer, We’d like to clarify that some customers may still see PHP version numbers such as 8.2.34, even after the security patching has been completed. This is expected for servers running CloudLinux. CloudLinux has applied the required security fixes to its existing PHP packages without necessarily changing the version number. As a result, your PHP version may appear older than the fixed versions listed in the official PHP announcements, but the security fix for CVE-2026-109618 and CVE-2026-109619 is already included. For example, CloudLinux’s PHP 8.2.34 package includes the required security fix, so upgrading specifically to PHP 8.2.35 is not necessary to address these vulnerabilities. Our teams continue to monitor the environment. Thank you for your patience and understanding as we continue to keep your hosting environment secure.
Your product runs on more than Digital Pacific
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services