Important PHP Security Alert: Critical Vulnerabilities Under Mitigation
Published: 21 October 2026
The security of our client websites and hosting accounts is a top priority. We are actively monitoring two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 that require attention from we the server administrators and you the website owners.These vulnerabilities involve PHP's handling of session upload progress during multipart HTTP requests. Security researchers have identified an exploit pattern circulating publicly, making timely mitigation an important priority for hosting environments.
Enhanced Protection Available Through Imunify360
The Imunify360 ModSecurity ruleset version 8.83 has been promoted to the Stable channel. This release introduces a new Web Application Firewall (WAF) rule designed to block the currently known exploit pattern associated with these vulnerabilities. An additional monitoring rule has also been introduced to help track related activity and all these have already been updated on our servers. Security teams are already observing requests matching the known exploit pattern and further detection measures are being developed to help identify additional variations.
Why a Permanent PHP Update Is Still Necessary
The new security rules provide an important layer of defense but they should not be considered a complete solution. The underlying vulnerabilities extend beyond the specific multipart upload scenario addressed by the current WAF rule. An official PHP security release was released today 21 October 2026 at 14:00 UTC. Updated alt-php packages containing the relevant fix are also in development. Package availability and deployment timelines will be communicated as further information becomes available. Until the permanent fix is released and applied, we will maintaining multiple layers of protection to help mitigate the issue.
Our Ongoing Security Response
We are following developments related to these vulnerabilities and the availability of permanent fixes. The current Imunify360 ruleset provides an additional defensive measure while the PHP-level correction is being prepared. We will share further information when updated packages and deployment guidance become available and update on our servers.
Your website's security is important to us. We encourage all customers to keep their applications updated and follow recommended security practices to reduce potential exposure.