Simply Hosting & Servers incident
PHP security vulnerabilities – customer update
Ongoing since 03:41 PM UTC.
On October 20, two critical PHP vulnerabilities were announced: CVE-2026-109618 and CVE-2026-109619. These vulnerabilities have a CVSS score of 9.2 and could potentially be exploited to execute code remotely on a server without requiring authentication. The vulnerabilities may affect all PHP versions starting from PHP 5. If you use PHP on your Bare Metal, Dedicated Server, VPS, we strongly recommend updating PHP with the patches that are available. If you are running cPanel/Plesk, patches are also available, and you should apply them. If you have a site/s running on these products from us, we recommend that you review your PHP usage and the version being used by you or your customers and take relevant actions. If you have managed server/vps with us, then these are/have been patched by our teams.
Update timeline
- monitoring Oct 22, 2026, 03:41 PM UTC
On October 20, two critical PHP vulnerabilities were announced: CVE-2026-109618 and CVE-2026-109619. These vulnerabilities have a CVSS score of 9.2 and could potentially be exploited to execute code remotely on a server without requiring authentication. The vulnerabilities may affect all PHP versions starting from PHP 5. If you use PHP on your Bare Metal, Dedicated Server, VPS, we strongly recommend updating PHP with the patches that are available. If you are running cPanel/Plesk, patches are also available, and you should apply them. If you have a site/s running on these products from us, we recommend that you review your PHP usage and the version being used by you or your customers and take relevant actions. If you have managed server/vps with us, then these are/have been patched by our teams.
Your product runs on more than Simply Hosting & Servers
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services