PHP UPDATE
RackNerd's response to PHP vulnerabilities CVE-2026-109618 / CVE-2026-109619. Proactively mitigated since October 20.
Note: For shared/reseller hosting customers - your PHP version number may not change, due to CloudLinux.
You're in good hands
We've been on this since October 20.
CVE-2026-109618 and CVE-2026-109619 are PHP vulnerabilities that matter on servers still running an unpatched PHP build. We started tracking them on October 20, and protections were already in place on shared and reseller hosting before public exploit code was circulating.
Your PHP version may look the same. CloudLinux backported the fix into the current ea-php packages for every PHP version we offer. WordPress, phpinfo, and MultiPHP keep showing the same version they showed before. That is expected. Rest assured, it is running on a patched build. On top of that, layers of defense were in place before these patches, and they remain in place as an extra precaution.
Shared and Reseller Hosting
Multiple layers of defense are in place, and no action is needed on these accounts.
Recommended PHP configuration changes, including the php.ini mitigations, are applied across our shared hosting servers.
Every shared server runs cPGuard. Additional WAF rules inspect incoming multipart request headers and block known malicious patterns before they reach the PHP parser. How that protection works.
These servers run LiteSpeed Enterprise, not Apache. Apache has been the highest-risk setup for this issue, and LiteSpeed has been responsive while the patches landed.
Shared hosting runs CloudLinux 9. The patched ea-php packages are installed across shared and reseller hosting, for every PHP version. CloudLinux kept the existing version number inside that update, so the version shown on your site can stay the same and still be the patched package. alt-php updates are applied as CloudLinux publishes them. Follow the CloudLinux rollout.
If you are a shared/reseller hosting customer, no action is required from your end. These updates are handled proactively by our team.
VPS and Dedicated Servers
VPS and dedicated servers are unmanaged by default. You have full control of the server, so keeping PHP and the rest of the operating system updated is part of running it. If PHP is installed, apply the patched package once it is available for your operating system.
Este elemento está agotado, por lo que se han suspendido los pedidos hasta que haya más existencias disponibles. Para más información, póngase en contacto con nosotros.
