Elitehost - PHP Security Vulnerabilities Patched – Incident details

All systems operational

PHP Security Vulnerabilities Patched

Monitoring
Operational
Started about 1 hour ago

Affected

Web Hosting Services

Operational from 9:31 AM to 12:00 AM

Updates
  • Monitoring
    UTC
    Monitoring

    Security updates addressing PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 have already been applied across all our hosting servers, including backported fixes for older PHP versions.

    • Proactive Exposure Reduction: On the morning of 21 October, prior to official vendor patch releases, temporary mitigations were immediately deployed across all servers, including disabling PHP's session upload progress feature.

    • Firewall Rule Deployment: Updated Imunify360 Web Application Firewall (WAF) rules were applied server-wide to actively detect and block known exploit vectors.

    • PHP Updates: Official security updates from cPanel and CloudLinux, including backported fixes for legacy PHP releases, have been installed.

    • Version Display Notice: Software or command-line version checks (e.g., php -v display existing release numbers such as PHP 8.4.26) because CloudLinux backported the security patches directly without incrementing the release number. The package build timestamp of 21 October 2026 and our internal verification confirm that all security patches are active. We apologise for any confusion this may cause.

    No action is required from your side. However, we recommend keeping your site's applications, plugins and themes updated, and using an actively supported PHP version (PHP 8.2 or later).