Ensuring the stability and security of our clients’ websites is always our top priority. We want to provide a transparent update regarding recent industry-wide security disclosures and the proactive steps taken to keep all hosted environments fully protected.
By the night of October 22, comprehensive security patches provided by CloudLinux were deployed and verified across all active PHP versions on our servers.
Server-side mitigation complete: File upload progress tracking remains safely disabled, and the underlying exploit vector has been closed.
We appreciate your continued trust as we keep your web platforms running safely and reliably.
What Happened: PHP2Shell Vulnerabilities
On October 21, PHP developers announced two critical security vulnerabilities—commonly referred to as PHP2Shell (cataloged under CVE-2026-109618 and CVE-2026-109619). These vulnerabilities related to PHP’s file upload progress handling. Immediate mitigation measures were put in place on the same day, including disabling the vulnerable upload progress directive across the infrastructure. Resolution at the Server Level.By the night of October 22, comprehensive security patches provided by CloudLinux were deployed and verified across all active PHP versions on our servers.
No version number changes:
The patches were applied directly into the existing PHP builds, meaning version numbers remain unchanged while the underlying vulnerabilities are neutralized.Server-side mitigation complete: File upload progress tracking remains safely disabled, and the underlying exploit vector has been closed.
No action required from website owners:
Clients hosting with us do not need to perform any manual PHP updates or server configurations.Next Steps:
Individual Website Audits & Updates While the underlying server infrastructure is fully secured, we are taking extra precautions to guarantee complete site health across the board: Manual Inspections: Every client website hosted on our servers is currently undergoing a manual review and routine maintenance update.Direct Notification:
Each client will be contacted individually once their website’s specific review and updates are complete.Dedicated Follow-Up:
If your website is hosted with us and you have not received a personal update confirming your site's check within the coming days, please reach out directly so we can verify your status immediately.We appreciate your continued trust as we keep your web platforms running safely and reliably.
