PHP Security Vulnerability CVE-2026-109618 / CVE-2026-109619

Update timeline

1. investigating Oct 21, 2026, 12:46 PM UTC

   We are aware of the widely reported PHP security vulnerability (CVE-2026-109618 / CVE-2026-109619). Where we are aware of systems that are running potential impacted versions of PHP: - we are applying vendor/WAF rule mitigations for current known exploits - we are restricting IP access where this is not possible to prevent exploit - we have confirmed that web hosting services are receiving protection through our partnership with CloudLinux and the Immunify360 services we run. In some cases, we have also taken the proactive step to temporarily disable web services on systems in line with the current practice by several organisations. This is typically on systems where the current version of PHP is not supported, and is not likely to receive patch updates and will require further action to resolve. Customers hosting virtual infrastructure should urgently consider the advice from the ASD at (https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php, though at the time of release this site was offline). We anticipate most services will be restored early morning Sydney time (it will take some time for the updates to be released, applied and tested, and systems to be cleared).

2. monitoring Oct 21, 2026, 09:27 PM UTC

   Most systems have been patched overnight and there is minimal impact to services ongoing. We are continuing to identify andnnotify clients running systems we consider may be impacted.

3. resolved Oct 22, 2026, 11:21 AM UTC

   This incident has been resolved.