Critical PHP Vulnerabilities: CVE-2026-109618/ CVE-2026-109619

Resolved

This is now resolved.

Wed, Oct 21, 2026, 11:59 AM

(9 hours ago)

Affected components

No components marked as affected

Updates

Resolved

This is now resolved.

Wed, Oct 21, 2026, 11:59 AM

Monitoring

All Cito and Cloudlinux systems have been patched. Please see our blog for further updates: https://prostack.uk/blog/critical-php-security-update-october-2026/

Wed, Oct 21, 2026, 11:59 AM

Monitoring

The PHP security team has announced that they will release fixes for two critical vulnerabilities, both rated 9.2 out of 10 (CVSS v4.0), on Wednesday 21 October 2026 at 14:00 UTC (3pm UK time).

Details of the vulnerabilities are currently under embargo. When the patches are released we will work to apply them to our fleet as quickly as possible. The vulnerabilities have been assigned CVE-2026-109618 and CVE-2026-109619.

Please refer to our blog post for further information and updates: https://prostack.uk/blog/critical-php-security-update-october-2026/

Wed, Oct 21, 2026, 09:25 AM(2 hours earlier)