Dear CCIHosting Customer,

We are issuing an important security advisory regarding two recently disclosed CRITICAL vulnerabilities affecting PHP, the programming language used by many websites and applications hosted on our infrastructure.

The PHP Security Team has released emergency security updates on October 21, 2026, addressing vulnerabilities that could potentially allow unauthorized attackers to execute malicious code on affected servers.

Security Vulnerabilities

  • CVE-2026-109618 – Critical Remote Code Execution vulnerability.

  • CVE-2026-109619 – Critical Remote Code Execution vulnerability.

  • Severity: CRITICAL (CVSS 9.2/10).

  • Affected software: PHP installations, including versions dating back to PHP 5.

These vulnerabilities are within PHP itself, not in the cPanel & WHM software. However, servers running cPanel & WHM, WordPress, Joomla, Magento, and other PHP-based applications may be affected.

Available Security Updates

The PHP project has released the following corrected versions:

PHP Branch Security Release
PHP 8.5 8.5.12
PHP 8.4 8.4.27
PHP 8.3 8.3.36
PHP 8.2 8.2.35

Important: Customers using older, end-of-life PHP versions should prioritize migrating to a supported release. Certain vendors may provide backported security fixes for legacy versions.

cPanel has announced that updated PHP packages will be distributed through its standard cPanel & WHM and EasyApache update channels.

What CCIHosting Is Doing

Our technical team is following the security advisories and coordinating the deployment of applicable updates across our managed hosting infrastructure as vendor packages become available.

Our priorities include:

  • Reviewing affected PHP installations and available security patches.

  • Applying applicable vendor-provided security updates.

  • Monitoring our hosting infrastructure for suspicious activity.

  • Minimizing service interruptions during the update process.

Action Required From Customers

Shared Hosting Customers

Customers using CCIHosting-managed shared hosting services generally do not need to perform server-level updates. Our technical team will coordinate applicable infrastructure updates.

We nevertheless recommend reviewing website applications, plugins, themes, and PHP compatibility.

VPS and Dedicated Server Customers

Customers managing their own VPS or dedicated servers should take immediate action:

  1. Verify which PHP versions are installed.

  2. Install the latest security updates supplied by the operating system or control-panel vendor.

  3. Review cPanel & WHM and EasyApache update settings, where applicable.

  4. Upgrade unsupported PHP versions whenever possible.

  5. Ensure that recent backups are available before performing major software upgrades.

Please do not assume that a server is protected solely because automatic updates are enabled. Verify that the appropriate security patches have actually been installed.

Additional Information

Official PHP Security Advisory:

https://www.php.net/

CCIHosting will continue monitoring vendor security notifications and provide further information as applicable updates become available.

If you require assistance evaluating your hosting environment or applying security patches, please contact our technical support team through your CCIHosting customer portal.

We appreciate your cooperation in maintaining a secure hosting environment.

Best regards,

CCIHosting Security & Infrastructure Team
Cyber Cast International, S.A.

 



Wednesday, October 21, 2026

« Back