Return Home

Critical PHP Security Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
Wednesday 21st October 2026 16:26:20

Two critical security vulnerabilities affecting PHP itself have been identified. Details of the vulnerabilities leaked publicly on Tuesday, October 20, 2026, ahead of their planned disclosure, and the PHP security team has scheduled an emergency security release for Wednesday, October 21, 2026 at 14:00 UTC (approximately 10:00 PM AWST, Wednesday, October 21).

Please note: Customers on our Shared Hosting platform or on a VPS with a maintenance plan do not need to take any action. WebClick will apply the patch on your behalf.

Most shared hosting web servers have been patched with the latest versions of PHP. Our technicians worked through the night to ensure nodes were patched and are now addressing older systems and running tests.

Posted 5 days ago by admin

Technicians continue to assist customers with virtual servers to update their software. We are monitoring the shared hosting servers and tweaking mitigation techniques based on the latest information available.

Posted 4 days ago by admin

We are continuing to work with our customers to ensure their virtual servers are updated and websites are migrated to the patched versions of PHP.

Posted 2 hours ago by admin