PHP security response
We are actively working through the new PHP security advisories. Our priorities are to identify affected services, validate additional safeguards, and prepare permanent updates without overlooking website compatibility.
Advisories have been reviewed and the hosting software inventory has been checked. We are checking vendor protection rules and the availability of supported server updates. Broad rollout and final verification are not yet marked complete.
24/7 automated monitoring: our scheduled checks follow official PHP announcements, PHP release feeds, the two advisories, and the relevant hosting vendor's release updates around the clock. The latest verified check of these sources completed at . We review new information as the response progresses; automated monitoring is not a promise that every possible source or attack is covered.
What a virtual patch means
A virtual patch is an extra filter designed to stop a known harmful request before it reaches a website. It can help reduce exposure while permanent updates are prepared. It is not a replacement for updating PHP, and one filter cannot be assumed to cover every way a vulnerability might be used.
Our response lifecycle
- COMPLETED INITIAL REVIEW
Understand the advisory
Confirm the official information and identify the software and services that need attention.
- CURRENT
Validate safeguards and updates
Check available vendor filters, update packages, compatibility, and recovery arrangements. Temporary safeguards and permanent server fixes are tracked separately.
- NEXT, WHEN VALIDATED
Roll out carefully
Apply qualified changes in controlled steps. An available vendor release is not the same as a completed update on our services.
- NOT YET COMPLETE
Verify the result
Confirm that updates are in use and normal website functions still work. We only label protection as deployed or verified when those checks support it.
- CONTINUING THROUGHOUT
Keep watching and refine
Follow official advisories and relevant vendor release channels, review changes, and revisit temporary filters after permanent fixes are verified.
What customers should know
PHP has released security updates. Hosting vendors may distribute their own compatible packages on a different schedule. If your server is managed elsewhere, ask that provider to confirm the relevant PHP fixes are installed and in use. A CDN or WAF alone is not confirmation that a server has been patched.
We will update this page as verified milestones change. We keep public updates straightforward and do not publish internal defensive settings or exploit instructions.
Current coverage statement: assessment is active. This page does not claim that every service is patched, that every exploit is blocked, or that verification is complete.
Official references
This response tracks CVE-2026-109618 and CVE-2026-109619. See PHP's official security announcement, the first PHP advisory, the second PHP advisory, and CloudLinux's release and temporary-protection updates.