!Critical PHP Security Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

Update timeline

1. investigating Oct 21, 2026, 08:21 AM UTC

   Two critical security vulnerabilities affecting PHP itself have been identified. Details of the vulnerabilities leaked publicly on Tuesday, October 20, 2026, ahead of their planned disclosure, and the PHP security team has scheduled an emergency security release for Wednesday, October 21, 2026 at 14:00 UTC (approximately 10:00 PM AWST, Wednesday, October 21). Please note: Customers on our Shared Hosting platform or on a VPS with a maintenance plan do not need to take any action. HostAway will apply the patch on your behalf.

2. monitoring Oct 22, 2026, 01:31 AM UTC

   Shared hosting web servers have been patched with the latest versions of PHP. Our technicians worked through the night to ensure all nodes were patched and are now addressing subsidiary systems and running tests.

3. monitoring Oct 23, 2026, 03:08 AM UTC

   Technicians continue to assist customers with virtual servers to update their software. We are also working on re-enabling the Members Panel soon.

4. investigating Oct 27, 2026, 08:55 AM UTC

   Thank you for your patience whilst we continue to work on patching the Members Panel and making it available for use. The rough estimate at this stage is late on Wednesday.

5. investigating Oct 29, 2026, 04:39 AM UTC

   The Members Panel is back online. Most functions are present however we are still working on rebuilding a few features - please contact support should you need anything or if you encounter any issues.