[Action Required] Critical PHP Security Update
-
Thursday, 22nd October, 2026
-
12:27pm
Security Announcement: Critical PHP Vulnerabilities (CVE-2026-109618 / CVE-2026-109619)
Priority: Critical — Action Required Immediately
Dear Valued Customers and Resellers,
The PHP project has released emergency security updates to address two critical vulnerabilities in PHP that allow unauthenticated remote code execution (RCE) . These vulnerabilities affect servers running PHP, including those using cPanel and DirectAdmin, and impact applications such as WordPress and other PHP-based software.
The PHP project rates both vulnerabilities as Critical (CVSS 9.2). There are no complete mitigations other than updating PHP
Affected Versions
| PHP Branch |
Affected Versions |
Required Action |
| PHP 5.x |
All versions |
End-of-life — upgrade to a supported branch immediately |
| PHP 7.x |
All versions |
End-of-life — upgrade to a supported branch immediately |
| PHP 8.2 |
Versions prior to 8.2.35 |
Update to 8.2.35 |
| PHP 8.3 |
Versions prior to 8.3.36 |
Update to 8.3.36 |
| PHP 8.4 |
Versions prior to 8.4.27 |
Update to 8.4.27 |
| PHP 8.5 |
Versions prior to 8.5.12 |
Update to 8.5.12 |
Source: PHP Foundation and vendor advisories
What You Need to Do
If you are on a shared hosting plan with Nocser.net:
- We will perform the server backend update.
- Customers are required to check and update their websites to be compatible with at least PHP 8.2.35.
- Resellers are required to check and update their clients' websites to be compatible with patched version
- We will enforce the PHP version update on your all website. Vulnerable php version will be remove from server
If you manage your own Cloud or dedicated server through us:
- We will perform the server backend update.
- Customers and Resellers are required to check and update their websites to be compatible with at least PHP 8.2.35. We will enforce the PHP version update on your website upon your request
If you are on an unmanaged server:
- You are required to take responsibility for upgrading your own server and websites.
Additional Notes
- Updating WordPress, plugins, or themes will not resolve this issue. These vulnerabilities reside in PHP itself.
- Web application firewalls (WAFs) may reduce risk but are not a substitute for patching.
- After patching, we recommend reviewing your site for any signs of compromise (unfamiliar admin accounts, modified PHP files, or web shells).
- PHP 5.x and 7.x are end-of-life and will not receive official security fixes. Websites still running these versions must migrate to a supported PHP version as soon as possible.
Questions?
If you are unsure which PHP version your account is using, please check via your control panel or contact our support team. We are prioritizing this update across all managed servers.
Thank you for your prompt attention to this critical security matter.
Nocser.net Security Team
