Critical PHP Vulnerabilities: CVE-2026-109618/ CVE-2026-109619
Timeline · 3 updates
- monitoring Oct 21, 2026, 01:25 PM UTC
Status: Monitoring The PHP security team has announced: https://www.php.net/archive/2026.php#2026-10-20-1 that they will release fixes for two critical vulnerabilities, both rated 9.2 out of 10 (CVSS v4.0), on Wednesday 21 October 2026 at 14:00 UTC (3pm UK time). Details of the vulnerabilities are currently under embargo. When the patches are released we will work to apply them to our fleet as quickly as possible. The vulnerabilities have been assigned CVE-2026-109618 and CVE-2026-109619. Please refer to our blog post for further information and updates: https://prostack.uk/blog/critical-php-security-update-october-2026/
- monitoring Oct 21, 2026, 03:59 PM UTC
Status: Monitoring All Cito and Cloudlinux systems have been patched. Please see our blog for further updates: https://prostack.uk/blog/critical-php-security-update-october-2026/
- resolved Oct 21, 2026, 03:59 PM UTC
Status: Resolved This is now resolved.