PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
Critical In progress-
In progressIf your website or application handles sensitive data and you'd rather be safe than sorry, you can choose to make your website or application unreachable until the patch has been carried out.
You can do this by going to DirectAdmin -> opening File Manager -> going to the /domains/yourdomain.xx folder -> renaming the public_html folder there to, for example, public_htmloud. The code in this folder will then no longer be accessible. -> After the patch, rename the folder back to public_html to make everything accessible again. -
In progressTwo new critical PHP vulnerabilities have been discovered that are believed to impact all PHP versions. You can find more information about this in this article:
https://tweakers.net/nieuws/253568/php-waarschuwt-voor-twee-ernstige-bugs-die-makkelijk-uit-te-buiten-lijken.html
Our team is on top of this, and as soon as a mitigation or patch becomes available, we will deploy it across all our servers.
The official PHP patch is not expected to apply to versions older than 8.2. Is your site still running on an older version? Then we recommend updating it as soon as possible to at least 8.3.
Here's how to do this: https://www.weboke.nl/knowledgebase/212/PHP-versie-wijzigen.html
Please note: If parts of your website are not up to date, your website may stop working. Identify these components and disable them, or update them where possible.
Our servers use CloudLinux, which releases backports for older PHP versions when security patches are issued, allowing older versions to also be protected. We expect these backports to become available with some delay.
Should we deem it necessary, we will temporarily make all our servers unreachable to safeguard the security of our customers' websites. Once the security patch has been applied, everything will come back online.
After the patches have been implemented, we will run extensive malware scans on all our servers to verify everything is secure.
These vulnerabilities affect all hosting providers and the vast majority of websites worldwide.
Last update: 21 October 2026, 10:23
