Prostack incident

Critical PHP Vulnerabilities: CVE-2026-109618/ CVE-2026-109619

Minor Resolved View vendor source →

Prostack experienced a minor incident on October 21, 2026, lasting 2h 34m. The incident has been resolved; the full update timeline is below.

Started
Oct 21, 2026, 01:25 PM UTC
Resolved
Oct 21, 2026, 03:59 PM UTC
Duration
2h 34m
Detected by Pingoru
Oct 21, 2026, 01:25 PM UTC

Update timeline

  1. monitoring Oct 21, 2026, 01:25 PM UTC

    Status: Monitoring The PHP security team has announced: https://www.php.net/archive/2026.php#2026-10-20-1 that they will release fixes for two critical vulnerabilities, both rated 9.2 out of 10 (CVSS v4.0), on Wednesday 21 October 2026 at 14:00 UTC (3pm UK time). Details of the vulnerabilities are currently under embargo. When the patches are released we will work to apply them to our fleet as quickly as possible. The vulnerabilities have been assigned CVE-2026-109618 and CVE-2026-109619. Please refer to our blog post for further information and updates: https://prostack.uk/blog/critical-php-security-update-october-2026/

  2. monitoring Oct 21, 2026, 03:59 PM UTC

    Status: Monitoring All Cito and Cloudlinux systems have been patched. Please see our blog for further updates: https://prostack.uk/blog/critical-php-security-update-october-2026/

  3. resolved Oct 21, 2026, 03:59 PM UTC

    Status: Resolved This is now resolved.