Security Maintenance: PHP Configuration Updates

Update timeline

1. scheduled Oct 21, 2026, 01:27 PM UTC

   Our Systems Engineering and Security teams are actively deploying critical cPanel security updates to address the recently disclosed php2shell vulnerability across supported PHP versions. Shared Hosting: Monitoring & Preparing. We are awaiting the upstream security patch from CloudLinux for older PHP versions. Our engineering team is fully prepared to roll out cPanel updates across all shared hosting clusters immediately upon CloudLinux's release. You can follow upstream progress directly via the CloudLinux Incident [Status Page](https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5). We are applying urgent security mitigations across our server infrastructure to address recently disclosed PHP security vulnerabilities (CVE-2026-109618 / CVE-2026-109619). As part of this update, we are disabling the default PHP session.upload_progress.enabled setting. While standard platforms (including WordPress) remain unaffected, custom non-WordPress sites relying on PHP native file upload progress tracking may experience functionality changes.

2. identified Oct 21, 2026, 08:26 PM UTC

   Our Systems Engineering and Security teams are continuing to deploy critical cPanel security updates to address the recently disclosed php2shell vulnerability across supported PHP versions. Shared Hosting: Monitoring & Preparing. We are awaiting the upstream security patch from CloudLinux for older PHP versions. Our engineering team is fully prepared to roll out cPanel updates across all shared hosting clusters immediately upon CloudLinux's release.