Critical PHP Security Notice: CVE-2026-109618 and CVE-2026-109619
Date: 21 October 2026
Priority: Critical
Dear Valued Clients,
We would like to inform you that, following the disclosure of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, additional security protections have been deployed through Imunify360 to help safeguard websites hosted on our servers.
As your hosting provider, we take the security of your websites seriously. In addition to deploying the latest available Imunify360 Web Application Firewall (WAF) rules, we have updated supported PHP packages across our hosting infrastructure to help protect against these vulnerabilities.
Security Measures Deployed Through Imunify360
We have deployed the following Imunify360 WAF rule set updates to help detect and block known exploitation attempts associated with these vulnerabilities.
The following releases were deployed on 21 October 2026 (all times UTC):
- WAF Rule Set 8.83 — 09:08 UTC: Added protection against known exploit request patterns and improved detection of exploitation attempts.
- WAF Rule Set 8.84 — 13:07 UTC: Expanded protection to block publicly available exploit tools and additional malicious request patterns.
- WAF Rule Set 8.85 — 17:17 UTC: Strengthened protection against further exploit tool variations and improved detection of suspicious or malformed file-upload requests.
IP Reputation Protection: Imunify360 continuously updates its threat intelligence to help identify suspicious activity. On protected servers, IP addresses associated with scanning or exploitation attempts may be presented with a CAPTCHA challenge.
These protections are delivered through Imunify360 and applied automatically. No action is required from clients to activate these hosting-level protections.
Recommended Action
Although Imunify360 protection provides an additional layer of security, firewall rules are not a substitute for applying software security updates.
We recommend that all clients update their PHP version to an appropriate patched release. Please also ensure that your website’s content management system, plugins, themes, and other applications are kept up to date.
Recommended PHP Updates
To further strengthen your website’s security, we recommend using a PHP version that includes the relevant security fixes.
The following PHP releases are the recommended patched versions for their respective branches:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Please check your website’s current PHP version and upgrade to the appropriate patched release supported by your hosting environment.
Our technical team has updated supported PHP packages across our hosting infrastructure. However, the PHP version available in your hosting account may differ depending on your server configuration and updating server packages does not necessarily change the PHP version assigned to each domain.
Security Updates for Older PHP Versions
Security patches have also been released for older PHP branches, including PHP 7.x, PHP 8.0, and PHP 8.1, as well as legacy versions ranging from PHP 5.2 through PHP 5.6.
However, the availability of a security patch does not mean that an older PHP version continues to receive full security maintenance or is recommended for ongoing use. We strongly recommend migrating to a currently supported PHP version wherever possible.
PHP Compatibility and Website Owner Responsibilities
Before upgrading PHP, please ensure that your website, content management system, themes, plugins, and applications are compatible with the selected version. We recommend backing up your website files and database before making any changes and testing your website after the upgrade.
Clients are responsible for ensuring that their websites, themes, plugins, and applications are compatible with their selected PHP version. Any necessary updates, code modifications, or compatibility adjustments should be coordinated with their website developer or software provider.
Our support team can assist with hosting-related PHP configuration and advise which PHP versions are available in your hosting environment. Website development and code modifications are outside the scope of standard hosting support unless separately agreed.
CAPTCHA Challenges and Access Issues
Imunify360 may occasionally challenge legitimate visitors if their IP address is identified as suspicious.
If you experience repeated CAPTCHA challenges or believe your IP address has been incorrectly flagged:
- Complete the CAPTCHA as instructed.
- If the issue persists, contact our support team.
- Provide your domain, public IP address, approximate time of the incident, and a screenshot if available.
Our team will investigate and determine whether an exception or IP allowlisting is appropriate, subject to security checks.
Our Commitment to Your Security
We will continue monitoring emerging threats and deploying appropriate security measures to help protect websites hosted on our infrastructure.
While the PHP package updates and Imunify360 protections provide additional layers of defence, no single security measure eliminates every possible risk. Keeping PHP and your website applications up to date remains essential to maintaining a secure online presence.
If you require assistance checking your PHP version or configuring the PHP options available in your hosting account, please contact our support team.
Kind regards,
Support Team
