We've been on this since October 20.

You're in good hands. We have been tracking CVE-2026-109618 and CVE-2026-109619 since October 20, and protections were already in place on shared and reseller hosting before public exploit code was circulating.

Your PHP version may look the same. Unlike a traditional PHP update, CloudLinux backported the fix into its php packages. Because all of our shared hosting servers run CloudLinux OS, WordPress, phpinfo, and MultiPHP keep showing the same version they showed before. That version also stays below the version PHP itself published, for example 8.4.26 rather than 8.4.27. That is expected. Rest assured, it is running on a patched build. On top of that, layers of defense were in place before these patches, and they remain in place as an extra precaution.

Shared and Reseller Hosting

Multiple layers of defense are in place, and no action is needed on these accounts.

• All ea-php and alt-php packages have been updated from the CloudLinux repositories.
• Recommended PHP configuration changes, including the php.ini mitigations, are applied across our shared hosting servers.
• Every shared server runs cPGuard. Additional WAF rules inspect incoming multipart request headers and block known malicious patterns before they reach the PHP parser. How that protection works.
• These servers run LiteSpeed Enterprise, not Apache. Apache has been the highest-risk setup for this issue, and LiteSpeed has been responsive while the patches landed.

Shared/reseller servers runs CloudLinux OS 9. The patched packages are installed across the fleet, for every PHP version. CloudLinux kept the existing version number inside that update, so the version shown on your site can stay the same, and it stays below the version number PHP published. It is still the patched package. alt-php packages have been updated as well. You can follow the CloudLinux rollout here.

If you are a shared/reseller hosting customer, no action is required from your end. These updates are handled proactively by our team.

VPS and Dedicated Servers

VPS and dedicated servers are unmanaged by default. You have full control of the server, so keeping PHP and the rest of the operating system updated is part of running it. If PHP is installed, apply the patched package once it is available for your operating system.