PHP security vulnerabilities – customer update

Incident Report for Simply Hosting

Monitoring

On October 20, two critical PHP vulnerabilities were announced: CVE-2026-109618 and CVE-2026-109619. These vulnerabilities have a CVSS score of 9.2 and could potentially be exploited to execute code remotely on a server without requiring authentication.

The vulnerabilities may affect all PHP versions starting from PHP 5.

If you use PHP on your Bare Metal, Dedicated Server, VPS, we strongly recommend updating PHP with the patches that are available. If you are running cPanel/Plesk, patches are also available, and you should apply them. If you have a site/s running on these products from us, we recommend that you review your PHP usage and the version being used by you or your customers and take relevant actions.

If you have managed server/vps with us, then these are/have been patched by our teams.

Posted Oct 22, 2026 - 16:41 BST