Elitehost - Notice history

Security updates addressing Node.js vulnerabilities, including CVE-2026-111497, have been installed across all our hosting servers for all versions we provide through Node.js Selector (Setup Node.js App in cPanel).

Node.js 22, 24 and 26 have been updated to 22.23.4, 24.22.1 and 26.12.1. Versions 10, 12, 14, 16, 18, 19 and 20 have received vendor-provided backported security fixes.

Older Node.js versions retain their existing release numbers because CloudLinux has backported the security fixes into updated package builds.

All Node.js applications have been restarted to ensure the patched runtime is active. No action is required from your side.

We recommend keeping your application and its dependencies updated and using an actively supported Node.js version (Node.js 22 or later).

Security updates addressing PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 have already been applied across all our hosting servers, including backported fixes for older PHP versions.

• Proactive Exposure Reduction: On the morning of 21 October, prior to official vendor patch releases, temporary mitigations were immediately deployed across all servers, including disabling PHP's session upload progress feature.

• Firewall Rule Deployment: Updated Imunify360 Web Application Firewall (WAF) rules were applied server-wide to actively detect and block known exploit vectors.

• PHP Updates: Official security updates from cPanel and CloudLinux, including backported fixes for legacy PHP releases, have been installed.

• Version Display Notice: Software or command-line version checks (e.g., php -v display existing release numbers such as PHP 8.4.26) because CloudLinux backported the security patches directly without incrementing the release number. The package build timestamp of 21 October 2026 and our internal verification confirm that all security patches are active. We apologise for any confusion this may cause.

No action is required from your side. However, we recommend keeping your site's applications, plugins and themes updated, and using an actively supported PHP version (PHP 8.2 or later).